February 2018 - Linux-stable-mirror

[Linux-stable-mirror] Patch "x86/cpufeatures: Clean up Spectre v2 related CPUID flags" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled x86/cpufeatures: Clean up Spectre v2 related CPUID flags to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: x86-cpufeatures-clean-up-spectre-v2-related-cpuid-flags.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Thu Feb 8 03:30:27 CET 2018 From: David Woodhouse <dwmw(a)amazon.co.uk> Date: Sat, 27 Jan 2018 16:24:32 +0000 Subject: x86/cpufeatures: Clean up Spectre v2 related CPUID flags From: David Woodhouse <dwmw(a)amazon.co.uk> (cherry picked from commit 2961298efe1ea1b6fc0d7ee8b76018fa6c0bcef2) We want to expose the hardware features simply in /proc/cpuinfo as "ibrs", "ibpb" and "stibp". Since AMD has separate CPUID bits for those, use them as the user-visible bits. When the Intel SPEC_CTRL bit is set which indicates both IBRS and IBPB capability, set those (AMD) bits accordingly. Likewise if the Intel STIBP bit is set, set the AMD STIBP that's used for the generic hardware capability. Hide the rest from /proc/cpuinfo by putting "" in the comments. Including RETPOLINE and RETPOLINE_AMD which shouldn't be visible there. There are patches to make the sysfs vulnerabilities information non-readable by non-root, and the same should apply to all information about which mitigations are actually in use. Those *shouldn't* appear in /proc/cpuinfo. The feature bit for whether IBPB is actually used, which is needed for ALTERNATIVEs, is renamed to X86_FEATURE_USE_IBPB. Originally-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: ak(a)linux.intel.com Cc: dave.hansen(a)intel.com Cc: karahmed(a)amazon.de Cc: arjan(a)linux.intel.com Cc: torvalds(a)linux-foundation.org Cc: peterz(a)infradead.org Cc: bp(a)alien8.de Cc: pbonzini(a)redhat.com Cc: tim.c.chen(a)linux.intel.com Cc: gregkh(a)linux-foundation.org Link: https://lkml.kernel.org/r/1517070274-12128-2-git-send-email-dwmw@amazon.co.… Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- arch/x86/include/asm/cpufeatures.h | 18 +++++++++--------- arch/x86/include/asm/nospec-branch.h | 2 +- arch/x86/kernel/cpu/bugs.c | 7 +++---- arch/x86/kernel/cpu/intel.c | 31 +++++++++++++++++++++---------- 4 files changed, 34 insertions(+), 24 deletions(-) --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -194,15 +194,15 @@ #define X86_FEATURE_HW_PSTATE ( 7*32+ 8) /* AMD HW-PState */ #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */ -#define X86_FEATURE_RETPOLINE ( 7*32+12) /* Generic Retpoline mitigation for Spectre variant 2 */ -#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* AMD Retpoline mitigation for Spectre variant 2 */ +#define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */ +#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* "" AMD Retpoline mitigation for Spectre variant 2 */ -#define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* Fill RSB on context switches */ +#define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* "" Fill RSB on context switches */ /* Because the ALTERNATIVE scheme is for members of the X86_FEATURE club... */ #define X86_FEATURE_KAISER ( 7*32+31) /* CONFIG_PAGE_TABLE_ISOLATION w/o nokaiser */ -#define X86_FEATURE_IBPB ( 7*32+21) /* Indirect Branch Prediction Barrier enabled*/ +#define X86_FEATURE_USE_IBPB ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */ /* Virtualization flags: Linux defined, word 8 */ #define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ @@ -260,9 +260,9 @@ /* AMD-defined CPU features, CPUID level 0x80000008 (ebx), word 13 */ #define X86_FEATURE_CLZERO (13*32+0) /* CLZERO instruction */ #define X86_FEATURE_IRPERF (13*32+1) /* Instructions Retired Count */ -#define X86_FEATURE_AMD_PRED_CMD (13*32+12) /* Prediction Command MSR (AMD) */ -#define X86_FEATURE_AMD_SPEC_CTRL (13*32+14) /* Speculation Control MSR only (AMD) */ -#define X86_FEATURE_AMD_STIBP (13*32+15) /* Single Thread Indirect Branch Predictors (AMD) */ +#define X86_FEATURE_IBPB (13*32+12) /* Indirect Branch Prediction Barrier */ +#define X86_FEATURE_IBRS (13*32+14) /* Indirect Branch Restricted Speculation */ +#define X86_FEATURE_STIBP (13*32+15) /* Single Thread Indirect Branch Predictors */ /* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */ #define X86_FEATURE_DTHERM (14*32+ 0) /* Digital Thermal Sensor */ @@ -301,8 +301,8 @@ /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */ #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */ -#define X86_FEATURE_SPEC_CTRL (18*32+26) /* Speculation Control (IBRS + IBPB) */ -#define X86_FEATURE_STIBP (18*32+27) /* Single Thread Indirect Branch Predictors */ +#define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */ +#define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */ #define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */ /* --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -225,7 +225,7 @@ static inline void indirect_branch_predi "movl %[val], %%eax\n\t" "movl $0, %%edx\n\t" "wrmsr", - X86_FEATURE_IBPB) + X86_FEATURE_USE_IBPB) : : [msr] "i" (MSR_IA32_PRED_CMD), [val] "i" (PRED_CMD_IBPB) : "eax", "ecx", "edx", "memory"); --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -272,9 +272,8 @@ retpoline_auto: } /* Initialize Indirect Branch Prediction Barrier if supported */ - if (boot_cpu_has(X86_FEATURE_SPEC_CTRL) || - boot_cpu_has(X86_FEATURE_AMD_PRED_CMD)) { - setup_force_cpu_cap(X86_FEATURE_IBPB); + if (boot_cpu_has(X86_FEATURE_IBPB)) { + setup_force_cpu_cap(X86_FEATURE_USE_IBPB); pr_info("Enabling Indirect Branch Prediction Barrier\n"); } } @@ -307,7 +306,7 @@ ssize_t cpu_show_spectre_v2(struct devic return sprintf(buf, "Not affected\n"); return sprintf(buf, "%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], - boot_cpu_has(X86_FEATURE_IBPB) ? ", IBPB" : "", + boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "", spectre_v2_module_string()); } #endif --- a/arch/x86/kernel/cpu/intel.c +++ b/arch/x86/kernel/cpu/intel.c @@ -140,17 +140,28 @@ static void early_init_intel(struct cpui rdmsr(MSR_IA32_UCODE_REV, lower_word, c->microcode); } - if ((cpu_has(c, X86_FEATURE_SPEC_CTRL) || - cpu_has(c, X86_FEATURE_STIBP) || - cpu_has(c, X86_FEATURE_AMD_SPEC_CTRL) || - cpu_has(c, X86_FEATURE_AMD_PRED_CMD) || - cpu_has(c, X86_FEATURE_AMD_STIBP)) && bad_spectre_microcode(c)) { - pr_warn("Intel Spectre v2 broken microcode detected; disabling SPEC_CTRL\n"); - clear_cpu_cap(c, X86_FEATURE_SPEC_CTRL); + /* + * The Intel SPEC_CTRL CPUID bit implies IBRS and IBPB support, + * and they also have a different bit for STIBP support. Also, + * a hypervisor might have set the individual AMD bits even on + * Intel CPUs, for finer-grained selection of what's available. + */ + if (cpu_has(c, X86_FEATURE_SPEC_CTRL)) { + set_cpu_cap(c, X86_FEATURE_IBRS); + set_cpu_cap(c, X86_FEATURE_IBPB); + } + if (cpu_has(c, X86_FEATURE_INTEL_STIBP)) + set_cpu_cap(c, X86_FEATURE_STIBP); + + /* Now if any of them are set, check the blacklist and clear the lot */ + if ((cpu_has(c, X86_FEATURE_IBRS) || cpu_has(c, X86_FEATURE_IBPB) || + cpu_has(c, X86_FEATURE_STIBP)) && bad_spectre_microcode(c)) { + pr_warn("Intel Spectre v2 broken microcode detected; disabling Speculation Control\n"); + clear_cpu_cap(c, X86_FEATURE_IBRS); + clear_cpu_cap(c, X86_FEATURE_IBPB); clear_cpu_cap(c, X86_FEATURE_STIBP); - clear_cpu_cap(c, X86_FEATURE_AMD_SPEC_CTRL); - clear_cpu_cap(c, X86_FEATURE_AMD_PRED_CMD); - clear_cpu_cap(c, X86_FEATURE_AMD_STIBP); + clear_cpu_cap(c, X86_FEATURE_SPEC_CTRL); + clear_cpu_cap(c, X86_FEATURE_INTEL_STIBP); } /* Patches currently in stable-queue which might be from dwmw(a)amazon.co.uk are queue-4.9/x86-entry-64-push-extra-regs-right-away.patch queue-4.9/kvm-vmx-introduce-alloc_loaded_vmcs.patch queue-4.9/kvm-nvmx-eliminate-vmcs02-pool.patch queue-4.9/kvm-vmx-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/kvm-x86-add-ibpb-support.patch queue-4.9/kvm-svm-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/x86-cpufeatures-add-intel-feature-bits-for-speculation-control.patch queue-4.9/x86-retpoline-simplify-vmexit_fill_rsb.patch queue-4.9/x86-paravirt-remove-noreplace-paravirt-cmdline-option.patch queue-4.9/x86-cpufeatures-clean-up-spectre-v2-related-cpuid-flags.patch queue-4.9/documentation-document-array_index_nospec.patch queue-4.9/x86-usercopy-replace-open-coded-stac-clac-with-__uaccess_-begin-end.patch queue-4.9/x86-asm-move-status-from-thread_struct-to-thread_info.patch queue-4.9/x86-cpufeatures-add-cpuid_7_edx-cpuid-leaf.patch queue-4.9/kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch queue-4.9/x86-entry-64-remove-the-syscall64-fast-path.patch queue-4.9/x86-cpufeature-blacklist-spec_ctrl-pred_cmd-on-early-spectre-v2-microcodes.patch queue-4.9/x86-nospec-fix-header-guards-names.patch queue-4.9/x86-retpoline-avoid-retpolines-for-built-in-__init-functions.patch queue-4.9/vfs-fdtable-prevent-bounds-check-bypass-via-speculative-execution.patch queue-4.9/x86-uaccess-use-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/x86-cpu-bugs-make-retpoline-module-warning-conditional.patch queue-4.9/x86-spectre-check-config_retpoline-in-command-line-parser.patch queue-4.9/x86-implement-array_index_mask_nospec.patch queue-4.9/x86-alternative-print-unadorned-pointers.patch queue-4.9/x86-cpuid-fix-up-virtual-ibrs-ibpb-stibp-feature-bits-on-intel.patch queue-4.9/array_index_nospec-sanitize-speculative-array-de-references.patch queue-4.9/kvm-vmx-make-indirect-call-speculation-safe.patch queue-4.9/x86-cpufeatures-add-amd-feature-bits-for-speculation-control.patch queue-4.9/x86-spectre-fix-spelling-mistake-vunerable-vulnerable.patch queue-4.9/module-retpoline-warn-about-missing-retpoline-in-module.patch queue-4.9/x86-kvm-update-spectre-v1-mitigation.patch queue-4.9/x86-get_user-use-pointer-masking-to-limit-speculation.patch queue-4.9/x86-syscall-sanitize-syscall-table-de-references-under-speculation.patch queue-4.9/kvm-nvmx-vmx_complete_nested_posted_interrupt-can-t-fail.patch queue-4.9/x86-spectre-simplify-spectre_v2-command-line-parsing.patch queue-4.9/x86-msr-add-definitions-for-new-speculation-control-msrs.patch queue-4.9/x86-pti-make-unpoison-of-pgd-for-trusted-boot-work-for-real.patch queue-4.9/kvm-vmx-make-msr-bitmaps-per-vcpu.patch queue-4.9/x86-speculation-add-basic-ibpb-indirect-branch-prediction-barrier-support.patch queue-4.9/kvm-nvmx-mark-vmcs12-pages-dirty-on-l2-exit.patch queue-4.9/x86-pti-mark-constant-arrays-as-__initconst.patch queue-4.9/x86-speculation-fix-typo-ibrs_att-which-should-be-ibrs_all.patch queue-4.9/x86-spectre-report-get_user-mitigation-for-spectre_v1.patch queue-4.9/x86-introduce-barrier_nospec.patch queue-4.9/kvm-vmx-emulate-msr_ia32_arch_capabilities.patch queue-4.9/x86-bugs-drop-one-mitigation-from-dmesg.patch queue-4.9/x86-retpoline-remove-the-esp-rsp-thunk.patch queue-4.9/x86-pti-do-not-enable-pti-on-cpus-which-are-not-vulnerable-to-meltdown.patch queue-4.9/x86-introduce-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/nl80211-sanitize-array-index-in-parse_txq_params.patch

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] Patch "x86/asm: Move 'status' from thread_struct to thread_info" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled x86/asm: Move 'status' from thread_struct to thread_info to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: x86-asm-move-status-from-thread_struct-to-thread_info.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Thu Feb 8 03:32:24 CET 2018 From: Andy Lutomirski <luto(a)kernel.org> Date: Sun, 28 Jan 2018 10:38:50 -0800 Subject: x86/asm: Move 'status' from thread_struct to thread_info From: Andy Lutomirski <luto(a)kernel.org> (cherry picked from commit 37a8f7c38339b22b69876d6f5a0ab851565284e3) The TS_COMPAT bit is very hot and is accessed from code paths that mostly also touch thread_info::flags. Move it into struct thread_info to improve cache locality. The only reason it was in thread_struct is that there was a brief period during which arch-specific fields were not allowed in struct thread_info. Linus suggested further changing: ti->status &= ~(TS_COMPAT|TS_I386_REGS_POKED); to: if (unlikely(ti->status & (TS_COMPAT|TS_I386_REGS_POKED))) ti->status &= ~(TS_COMPAT|TS_I386_REGS_POKED); on the theory that frequently dirtying the cacheline even in pure 64-bit code that never needs to modify status hurts performance. That could be a reasonable followup patch, but I suspect it matters less on top of this patch. Suggested-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Andy Lutomirski <luto(a)kernel.org> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Ingo Molnar <mingo(a)kernel.org> Acked-by: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Borislav Petkov <bp(a)alien8.de> Cc: Kernel Hardening <kernel-hardening(a)lists.openwall.com> Link: https://lkml.kernel.org/r/03148bcc1b217100e6e8ecf6a5468c45cf4304b6.15171644… Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- arch/x86/entry/common.c | 4 ++-- arch/x86/include/asm/processor.h | 2 -- arch/x86/include/asm/syscall.h | 6 +++--- arch/x86/include/asm/thread_info.h | 3 ++- arch/x86/kernel/process_64.c | 4 ++-- arch/x86/kernel/ptrace.c | 2 +- arch/x86/kernel/signal.c | 2 +- 7 files changed, 11 insertions(+), 12 deletions(-) --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -201,7 +201,7 @@ __visible inline void prepare_exit_to_us * special case only applies after poking regs and before the * very next return to user mode. */ - current->thread.status &= ~(TS_COMPAT|TS_I386_REGS_POKED); + ti->status &= ~(TS_COMPAT|TS_I386_REGS_POKED); #endif user_enter_irqoff(); @@ -299,7 +299,7 @@ static __always_inline void do_syscall_3 unsigned int nr = (unsigned int)regs->orig_ax; #ifdef CONFIG_IA32_EMULATION - current->thread.status |= TS_COMPAT; + ti->status |= TS_COMPAT; #endif if (READ_ONCE(ti->flags) & _TIF_WORK_SYSCALL_ENTRY) { --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -391,8 +391,6 @@ struct thread_struct { unsigned short gsindex; #endif - u32 status; /* thread synchronous flags */ - #ifdef CONFIG_X86_64 unsigned long fsbase; unsigned long gsbase; --- a/arch/x86/include/asm/syscall.h +++ b/arch/x86/include/asm/syscall.h @@ -60,7 +60,7 @@ static inline long syscall_get_error(str * TS_COMPAT is set for 32-bit syscall entries and then * remains set until we return to user mode. */ - if (task->thread.status & (TS_COMPAT|TS_I386_REGS_POKED)) + if (task->thread_info.status & (TS_COMPAT|TS_I386_REGS_POKED)) /* * Sign-extend the value so (int)-EFOO becomes (long)-EFOO * and will match correctly in comparisons. @@ -116,7 +116,7 @@ static inline void syscall_get_arguments unsigned long *args) { # ifdef CONFIG_IA32_EMULATION - if (task->thread.status & TS_COMPAT) + if (task->thread_info.status & TS_COMPAT) switch (i) { case 0: if (!n--) break; @@ -177,7 +177,7 @@ static inline void syscall_set_arguments const unsigned long *args) { # ifdef CONFIG_IA32_EMULATION - if (task->thread.status & TS_COMPAT) + if (task->thread_info.status & TS_COMPAT) switch (i) { case 0: if (!n--) break; --- a/arch/x86/include/asm/thread_info.h +++ b/arch/x86/include/asm/thread_info.h @@ -54,6 +54,7 @@ struct task_struct; struct thread_info { unsigned long flags; /* low level flags */ + u32 status; /* thread synchronous flags */ }; #define INIT_THREAD_INFO(tsk) \ @@ -213,7 +214,7 @@ static inline int arch_within_stack_fram #define in_ia32_syscall() true #else #define in_ia32_syscall() (IS_ENABLED(CONFIG_IA32_EMULATION) && \ - current->thread.status & TS_COMPAT) + current_thread_info()->status & TS_COMPAT) #endif /* --- a/arch/x86/kernel/process_64.c +++ b/arch/x86/kernel/process_64.c @@ -538,7 +538,7 @@ void set_personality_ia32(bool x32) current->personality &= ~READ_IMPLIES_EXEC; /* in_compat_syscall() uses the presence of the x32 syscall bit flag to determine compat status */ - current->thread.status &= ~TS_COMPAT; + current_thread_info()->status &= ~TS_COMPAT; } else { set_thread_flag(TIF_IA32); clear_thread_flag(TIF_X32); @@ -546,7 +546,7 @@ void set_personality_ia32(bool x32) current->mm->context.ia32_compat = TIF_IA32; current->personality |= force_personality32; /* Prepare the first "return" to user space */ - current->thread.status |= TS_COMPAT; + current_thread_info()->status |= TS_COMPAT; } } EXPORT_SYMBOL_GPL(set_personality_ia32); --- a/arch/x86/kernel/ptrace.c +++ b/arch/x86/kernel/ptrace.c @@ -934,7 +934,7 @@ static int putreg32(struct task_struct * */ regs->orig_ax = value; if (syscall_get_nr(child, regs) >= 0) - child->thread.status |= TS_I386_REGS_POKED; + child->thread_info.status |= TS_I386_REGS_POKED; break; case offsetof(struct user32, regs.eflags): --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -785,7 +785,7 @@ static inline unsigned long get_nr_resta * than the tracee. */ #ifdef CONFIG_IA32_EMULATION - if (current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED)) + if (current_thread_info()->status & (TS_COMPAT|TS_I386_REGS_POKED)) return __NR_ia32_restart_syscall; #endif #ifdef CONFIG_X86_X32_ABI Patches currently in stable-queue which might be from luto(a)kernel.org are queue-4.9/x86-entry-64-push-extra-regs-right-away.patch queue-4.9/kvm-vmx-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/kvm-x86-add-ibpb-support.patch queue-4.9/kvm-svm-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/x86-paravirt-remove-noreplace-paravirt-cmdline-option.patch queue-4.9/x86-asm-move-status-from-thread_struct-to-thread_info.patch queue-4.9/kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch queue-4.9/x86-entry-64-remove-the-syscall64-fast-path.patch queue-4.9/x86-asm-fix-inline-asm-call-constraints-for-gcc-4.4.patch queue-4.9/kvm-vmx-make-indirect-call-speculation-safe.patch queue-4.9/x86-spectre-fix-spelling-mistake-vunerable-vulnerable.patch queue-4.9/x86-get_user-use-pointer-masking-to-limit-speculation.patch queue-4.9/x86-syscall-sanitize-syscall-table-de-references-under-speculation.patch queue-4.9/x86-pti-make-unpoison-of-pgd-for-trusted-boot-work-for-real.patch queue-4.9/x86-pti-mark-constant-arrays-as-__initconst.patch queue-4.9/kvm-vmx-emulate-msr_ia32_arch_capabilities.patch

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] Patch "x86/bugs: Drop one "mitigation" from dmesg" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled x86/bugs: Drop one "mitigation" from dmesg to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: x86-bugs-drop-one-mitigation-from-dmesg.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Thu Feb 8 03:30:27 CET 2018 From: Borislav Petkov <bp(a)suse.de> Date: Fri, 26 Jan 2018 13:11:39 +0100 Subject: x86/bugs: Drop one "mitigation" from dmesg From: Borislav Petkov <bp(a)suse.de> (cherry picked from commit 55fa19d3e51f33d9cd4056d25836d93abf9438db) Make [ 0.031118] Spectre V2 mitigation: Mitigation: Full generic retpoline into [ 0.031118] Spectre V2: Mitigation: Full generic retpoline to reduce the mitigation mitigations strings. Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: riel(a)redhat.com Cc: ak(a)linux.intel.com Cc: peterz(a)infradead.org Cc: David Woodhouse <dwmw2(a)infradead.org> Cc: jikos(a)kernel.org Cc: luto(a)amacapital.net Cc: dave.hansen(a)intel.com Cc: torvalds(a)linux-foundation.org Cc: keescook(a)google.com Cc: Josh Poimboeuf <jpoimboe(a)redhat.com> Cc: tim.c.chen(a)linux.intel.com Cc: pjt(a)google.com Link: https://lkml.kernel.org/r/20180126121139.31959-5-bp@alien8.de Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- arch/x86/kernel/cpu/bugs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -90,7 +90,7 @@ static const char *spectre_v2_strings[] }; #undef pr_fmt -#define pr_fmt(fmt) "Spectre V2 mitigation: " fmt +#define pr_fmt(fmt) "Spectre V2 : " fmt static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE; static bool spectre_v2_bad_module; Patches currently in stable-queue which might be from bp(a)suse.de are queue-4.9/x86-cpufeatures-add-intel-feature-bits-for-speculation-control.patch queue-4.9/x86-retpoline-simplify-vmexit_fill_rsb.patch queue-4.9/x86-cpufeatures-clean-up-spectre-v2-related-cpuid-flags.patch queue-4.9/x86-cpufeatures-add-cpuid_7_edx-cpuid-leaf.patch queue-4.9/x86-microcode-amd-do-not-load-when-running-on-a-hypervisor.patch queue-4.9/x86-nospec-fix-header-guards-names.patch queue-4.9/x86-alternative-print-unadorned-pointers.patch queue-4.9/x86-spectre-fix-spelling-mistake-vunerable-vulnerable.patch queue-4.9/x86-pti-mark-constant-arrays-as-__initconst.patch queue-4.9/x86-bugs-drop-one-mitigation-from-dmesg.patch queue-4.9/x86-pti-do-not-enable-pti-on-cpus-which-are-not-vulnerable-to-meltdown.patch

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] Patch "x86/alternative: Print unadorned pointers" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled x86/alternative: Print unadorned pointers to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: x86-alternative-print-unadorned-pointers.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Thu Feb 8 03:30:27 CET 2018 From: Borislav Petkov <bp(a)suse.de> Date: Fri, 26 Jan 2018 13:11:36 +0100 Subject: x86/alternative: Print unadorned pointers From: Borislav Petkov <bp(a)suse.de> (cherry picked from commit 0e6c16c652cadaffd25a6bb326ec10da5bcec6b4) After commit ad67b74d2469 ("printk: hash addresses printed with %p") pointers are being hashed when printed. However, this makes the alternative debug output completely useless. Switch to %px in order to see the unadorned kernel pointers. Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: riel(a)redhat.com Cc: ak(a)linux.intel.com Cc: peterz(a)infradead.org Cc: David Woodhouse <dwmw2(a)infradead.org> Cc: jikos(a)kernel.org Cc: luto(a)amacapital.net Cc: dave.hansen(a)intel.com Cc: torvalds(a)linux-foundation.org Cc: keescook(a)google.com Cc: Josh Poimboeuf <jpoimboe(a)redhat.com> Cc: tim.c.chen(a)linux.intel.com Cc: gregkh(a)linux-foundation.org Cc: pjt(a)google.com Link: https://lkml.kernel.org/r/20180126121139.31959-2-bp@alien8.de Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- arch/x86/kernel/alternative.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -298,7 +298,7 @@ recompute_jump(struct alt_instr *a, u8 * tgt_rip = next_rip + o_dspl; n_dspl = tgt_rip - orig_insn; - DPRINTK("target RIP: %p, new_displ: 0x%x", tgt_rip, n_dspl); + DPRINTK("target RIP: %px, new_displ: 0x%x", tgt_rip, n_dspl); if (tgt_rip - orig_insn >= 0) { if (n_dspl - 2 <= 127) @@ -352,7 +352,7 @@ static void __init_or_module optimize_no sync_core(); local_irq_restore(flags); - DUMP_BYTES(instr, a->instrlen, "%p: [%d:%d) optimized NOPs: ", + DUMP_BYTES(instr, a->instrlen, "%px: [%d:%d) optimized NOPs: ", instr, a->instrlen - a->padlen, a->padlen); } @@ -370,7 +370,7 @@ void __init_or_module apply_alternatives u8 *instr, *replacement; u8 insnbuf[MAX_PATCH_LEN]; - DPRINTK("alt table %p -> %p", start, end); + DPRINTK("alt table %px, -> %px", start, end); /* * The scan order should be from start to end. A later scanned * alternative code can overwrite previously scanned alternative code. @@ -394,14 +394,14 @@ void __init_or_module apply_alternatives continue; } - DPRINTK("feat: %d*32+%d, old: (%p, len: %d), repl: (%p, len: %d), pad: %d", + DPRINTK("feat: %d*32+%d, old: (%px len: %d), repl: (%px, len: %d), pad: %d", a->cpuid >> 5, a->cpuid & 0x1f, instr, a->instrlen, replacement, a->replacementlen, a->padlen); - DUMP_BYTES(instr, a->instrlen, "%p: old_insn: ", instr); - DUMP_BYTES(replacement, a->replacementlen, "%p: rpl_insn: ", replacement); + DUMP_BYTES(instr, a->instrlen, "%px: old_insn: ", instr); + DUMP_BYTES(replacement, a->replacementlen, "%px: rpl_insn: ", replacement); memcpy(insnbuf, replacement, a->replacementlen); insnbuf_sz = a->replacementlen; @@ -422,7 +422,7 @@ void __init_or_module apply_alternatives a->instrlen - a->replacementlen); insnbuf_sz += a->instrlen - a->replacementlen; } - DUMP_BYTES(insnbuf, insnbuf_sz, "%p: final_insn: ", instr); + DUMP_BYTES(insnbuf, insnbuf_sz, "%px: final_insn: ", instr); text_poke_early(instr, insnbuf, insnbuf_sz); } Patches currently in stable-queue which might be from bp(a)suse.de are queue-4.9/x86-cpufeatures-add-intel-feature-bits-for-speculation-control.patch queue-4.9/x86-retpoline-simplify-vmexit_fill_rsb.patch queue-4.9/x86-cpufeatures-clean-up-spectre-v2-related-cpuid-flags.patch queue-4.9/x86-cpufeatures-add-cpuid_7_edx-cpuid-leaf.patch queue-4.9/x86-microcode-amd-do-not-load-when-running-on-a-hypervisor.patch queue-4.9/x86-nospec-fix-header-guards-names.patch queue-4.9/x86-alternative-print-unadorned-pointers.patch queue-4.9/x86-spectre-fix-spelling-mistake-vunerable-vulnerable.patch queue-4.9/x86-pti-mark-constant-arrays-as-__initconst.patch queue-4.9/x86-bugs-drop-one-mitigation-from-dmesg.patch queue-4.9/x86-pti-do-not-enable-pti-on-cpus-which-are-not-vulnerable-to-meltdown.patch

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] Patch "nl80211: Sanitize array index in parse_txq_params" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled nl80211: Sanitize array index in parse_txq_params to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: nl80211-sanitize-array-index-in-parse_txq_params.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Thu Feb 8 03:32:24 CET 2018 From: Dan Williams <dan.j.williams(a)intel.com> Date: Mon, 29 Jan 2018 17:03:15 -0800 Subject: nl80211: Sanitize array index in parse_txq_params From: Dan Williams <dan.j.williams(a)intel.com> (cherry picked from commit 259d8c1e984318497c84eef547bbb6b1d9f4eb05) Wireless drivers rely on parse_txq_params to validate that txq_params->ac is less than NL80211_NUM_ACS by the time the low-level driver's ->conf_tx() handler is called. Use a new helper, array_index_nospec(), to sanitize txq_params->ac with respect to speculation. I.e. ensure that any speculation into ->conf_tx() handlers is done with a value of txq_params->ac that is within the bounds of [0, NL80211_NUM_ACS). Reported-by: Christian Lamparter <chunkeey(a)gmail.com> Reported-by: Elena Reshetova <elena.reshetova(a)intel.com> Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: Johannes Berg <johannes(a)sipsolutions.net> Cc: linux-arch(a)vger.kernel.org Cc: kernel-hardening(a)lists.openwall.com Cc: gregkh(a)linuxfoundation.org Cc: linux-wireless(a)vger.kernel.org Cc: torvalds(a)linux-foundation.org Cc: "David S. Miller" <davem(a)davemloft.net> Cc: alan(a)linux.intel.com Link: https://lkml.kernel.org/r/151727419584.33451.7700736761686184303.stgit@dwil… Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- net/wireless/nl80211.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -16,6 +16,7 @@ #include <linux/nl80211.h> #include <linux/rtnetlink.h> #include <linux/netlink.h> +#include <linux/nospec.h> #include <linux/etherdevice.h> #include <net/net_namespace.h> #include <net/genetlink.h> @@ -2014,20 +2015,22 @@ static const struct nla_policy txq_param static int parse_txq_params(struct nlattr *tb[], struct ieee80211_txq_params *txq_params) { + u8 ac; + if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || !tb[NL80211_TXQ_ATTR_AIFS]) return -EINVAL; - txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); + ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); - if (txq_params->ac >= NL80211_NUM_ACS) + if (ac >= NL80211_NUM_ACS) return -EINVAL; - + txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS); return 0; } Patches currently in stable-queue which might be from dan.j.williams(a)intel.com are queue-4.9/kvm-vmx-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/kvm-x86-add-ibpb-support.patch queue-4.9/kvm-svm-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/x86-paravirt-remove-noreplace-paravirt-cmdline-option.patch queue-4.9/documentation-document-array_index_nospec.patch queue-4.9/x86-usercopy-replace-open-coded-stac-clac-with-__uaccess_-begin-end.patch queue-4.9/kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch queue-4.9/vfs-fdtable-prevent-bounds-check-bypass-via-speculative-execution.patch queue-4.9/x86-uaccess-use-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/x86-implement-array_index_mask_nospec.patch queue-4.9/array_index_nospec-sanitize-speculative-array-de-references.patch queue-4.9/kvm-vmx-make-indirect-call-speculation-safe.patch queue-4.9/x86-kvm-update-spectre-v1-mitigation.patch queue-4.9/x86-get_user-use-pointer-masking-to-limit-speculation.patch queue-4.9/x86-syscall-sanitize-syscall-table-de-references-under-speculation.patch queue-4.9/x86-spectre-report-get_user-mitigation-for-spectre_v1.patch queue-4.9/x86-introduce-barrier_nospec.patch queue-4.9/kvm-vmx-emulate-msr_ia32_arch_capabilities.patch queue-4.9/x86-introduce-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/nl80211-sanitize-array-index-in-parse_txq_params.patch

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] Patch "vfs, fdtable: Prevent bounds-check bypass via speculative execution" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled vfs, fdtable: Prevent bounds-check bypass via speculative execution to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: vfs-fdtable-prevent-bounds-check-bypass-via-speculative-execution.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Thu Feb 8 03:32:24 CET 2018 From: Dan Williams <dan.j.williams(a)intel.com> Date: Mon, 29 Jan 2018 17:03:05 -0800 Subject: vfs, fdtable: Prevent bounds-check bypass via speculative execution From: Dan Williams <dan.j.williams(a)intel.com> (cherry picked from commit 56c30ba7b348b90484969054d561f711ba196507) 'fd' is a user controlled value that is used as a data dependency to read from the 'fdt->fd' array. In order to avoid potential leaks of kernel memory values, block speculative execution of the instruction stream that could issue reads based on an invalid 'file *' returned from __fcheck_files. Co-developed-by: Elena Reshetova <elena.reshetova(a)intel.com> Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: linux-arch(a)vger.kernel.org Cc: kernel-hardening(a)lists.openwall.com Cc: gregkh(a)linuxfoundation.org Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: torvalds(a)linux-foundation.org Cc: alan(a)linux.intel.com Link: https://lkml.kernel.org/r/151727418500.33451.17392199002892248656.stgit@dwi… Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- include/linux/fdtable.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/include/linux/fdtable.h +++ b/include/linux/fdtable.h @@ -9,6 +9,7 @@ #include <linux/compiler.h> #include <linux/spinlock.h> #include <linux/rcupdate.h> +#include <linux/nospec.h> #include <linux/types.h> #include <linux/init.h> #include <linux/fs.h> @@ -81,8 +82,10 @@ static inline struct file *__fcheck_file { struct fdtable *fdt = rcu_dereference_raw(files->fdt); - if (fd < fdt->max_fds) + if (fd < fdt->max_fds) { + fd = array_index_nospec(fd, fdt->max_fds); return rcu_dereference_raw(fdt->fd[fd]); + } return NULL; } Patches currently in stable-queue which might be from dan.j.williams(a)intel.com are queue-4.9/kvm-vmx-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/kvm-x86-add-ibpb-support.patch queue-4.9/kvm-svm-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/x86-paravirt-remove-noreplace-paravirt-cmdline-option.patch queue-4.9/documentation-document-array_index_nospec.patch queue-4.9/x86-usercopy-replace-open-coded-stac-clac-with-__uaccess_-begin-end.patch queue-4.9/kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch queue-4.9/vfs-fdtable-prevent-bounds-check-bypass-via-speculative-execution.patch queue-4.9/x86-uaccess-use-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/x86-implement-array_index_mask_nospec.patch queue-4.9/array_index_nospec-sanitize-speculative-array-de-references.patch queue-4.9/kvm-vmx-make-indirect-call-speculation-safe.patch queue-4.9/x86-kvm-update-spectre-v1-mitigation.patch queue-4.9/x86-get_user-use-pointer-masking-to-limit-speculation.patch queue-4.9/x86-syscall-sanitize-syscall-table-de-references-under-speculation.patch queue-4.9/x86-spectre-report-get_user-mitigation-for-spectre_v1.patch queue-4.9/x86-introduce-barrier_nospec.patch queue-4.9/kvm-vmx-emulate-msr_ia32_arch_capabilities.patch queue-4.9/x86-introduce-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/nl80211-sanitize-array-index-in-parse_txq_params.patch

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] Patch "array_index_nospec: Sanitize speculative array de-references" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled array_index_nospec: Sanitize speculative array de-references to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: array_index_nospec-sanitize-speculative-array-de-references.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Thu Feb 8 03:32:24 CET 2018 From: Dan Williams <dan.j.williams(a)intel.com> Date: Mon, 29 Jan 2018 17:02:22 -0800 Subject: array_index_nospec: Sanitize speculative array de-references From: Dan Williams <dan.j.williams(a)intel.com> (cherry picked from commit f3804203306e098dae9ca51540fcd5eb700d7f40) array_index_nospec() is proposed as a generic mechanism to mitigate against Spectre-variant-1 attacks, i.e. an attack that bypasses boundary checks via speculative execution. The array_index_nospec() implementation is expected to be safe for current generation CPUs across multiple architectures (ARM, x86). Based on an original implementation by Linus Torvalds, tweaked to remove speculative flows by Alexei Starovoitov, and tweaked again by Linus to introduce an x86 assembly implementation for the mask generation. Co-developed-by: Linus Torvalds <torvalds(a)linux-foundation.org> Co-developed-by: Alexei Starovoitov <ast(a)kernel.org> Suggested-by: Cyril Novikov <cnovikov(a)lynx.com> Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: linux-arch(a)vger.kernel.org Cc: kernel-hardening(a)lists.openwall.com Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Will Deacon <will.deacon(a)arm.com> Cc: Russell King <linux(a)armlinux.org.uk> Cc: gregkh(a)linuxfoundation.org Cc: torvalds(a)linux-foundation.org Cc: alan(a)linux.intel.com Link: https://lkml.kernel.org/r/151727414229.33451.18411580953862676575.stgit@dwi… Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- include/linux/nospec.h | 72 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 include/linux/nospec.h --- /dev/null +++ b/include/linux/nospec.h @@ -0,0 +1,72 @@ +// SPDX-License-Identifier: GPL-2.0 +// Copyright(c) 2018 Linus Torvalds. All rights reserved. +// Copyright(c) 2018 Alexei Starovoitov. All rights reserved. +// Copyright(c) 2018 Intel Corporation. All rights reserved. + +#ifndef _LINUX_NOSPEC_H +#define _LINUX_NOSPEC_H + +/** + * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise + * @index: array element index + * @size: number of elements in array + * + * When @index is out of bounds (@index >= @size), the sign bit will be + * set. Extend the sign bit to all bits and invert, giving a result of + * zero for an out of bounds index, or ~0 if within bounds [0, @size). + */ +#ifndef array_index_mask_nospec +static inline unsigned long array_index_mask_nospec(unsigned long index, + unsigned long size) +{ + /* + * Warn developers about inappropriate array_index_nospec() usage. + * + * Even if the CPU speculates past the WARN_ONCE branch, the + * sign bit of @index is taken into account when generating the + * mask. + * + * This warning is compiled out when the compiler can infer that + * @index and @size are less than LONG_MAX. + */ + if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, + "array_index_nospec() limited to range of [0, LONG_MAX]\n")) + return 0; + + /* + * Always calculate and emit the mask even if the compiler + * thinks the mask is not needed. The compiler does not take + * into account the value of @index under speculation. + */ + OPTIMIZER_HIDE_VAR(index); + return ~(long)(index | (size - 1UL - index)) >> (BITS_PER_LONG - 1); +} +#endif + +/* + * array_index_nospec - sanitize an array index after a bounds check + * + * For a code sequence like: + * + * if (index < size) { + * index = array_index_nospec(index, size); + * val = array[index]; + * } + * + * ...if the CPU speculates past the bounds check then + * array_index_nospec() will clamp the index within the range of [0, + * size). + */ +#define array_index_nospec(index, size) \ +({ \ + typeof(index) _i = (index); \ + typeof(size) _s = (size); \ + unsigned long _mask = array_index_mask_nospec(_i, _s); \ + \ + BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ + BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ + \ + _i &= _mask; \ + _i; \ +}) +#endif /* _LINUX_NOSPEC_H */ Patches currently in stable-queue which might be from dan.j.williams(a)intel.com are queue-4.9/kvm-vmx-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/kvm-x86-add-ibpb-support.patch queue-4.9/kvm-svm-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/x86-paravirt-remove-noreplace-paravirt-cmdline-option.patch queue-4.9/documentation-document-array_index_nospec.patch queue-4.9/x86-usercopy-replace-open-coded-stac-clac-with-__uaccess_-begin-end.patch queue-4.9/kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch queue-4.9/vfs-fdtable-prevent-bounds-check-bypass-via-speculative-execution.patch queue-4.9/x86-uaccess-use-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/x86-implement-array_index_mask_nospec.patch queue-4.9/array_index_nospec-sanitize-speculative-array-de-references.patch queue-4.9/kvm-vmx-make-indirect-call-speculation-safe.patch queue-4.9/x86-kvm-update-spectre-v1-mitigation.patch queue-4.9/x86-get_user-use-pointer-masking-to-limit-speculation.patch queue-4.9/x86-syscall-sanitize-syscall-table-de-references-under-speculation.patch queue-4.9/x86-spectre-report-get_user-mitigation-for-spectre_v1.patch queue-4.9/x86-introduce-barrier_nospec.patch queue-4.9/kvm-vmx-emulate-msr_ia32_arch_capabilities.patch queue-4.9/x86-introduce-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/nl80211-sanitize-array-index-in-parse_txq_params.patch

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] Patch "Documentation: Document array_index_nospec" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled Documentation: Document array_index_nospec to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: documentation-document-array_index_nospec.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Thu Feb 8 03:32:24 CET 2018 From: Mark Rutland <mark.rutland(a)arm.com> Date: Mon, 29 Jan 2018 17:02:16 -0800 Subject: Documentation: Document array_index_nospec From: Mark Rutland <mark.rutland(a)arm.com> (cherry picked from commit f84a56f73dddaeac1dba8045b007f742f61cd2da) Document the rationale and usage of the new array_index_nospec() helper. Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Will Deacon <will.deacon(a)arm.com> Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Kees Cook <keescook(a)chromium.org> Cc: linux-arch(a)vger.kernel.org Cc: Jonathan Corbet <corbet(a)lwn.net> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: gregkh(a)linuxfoundation.org Cc: kernel-hardening(a)lists.openwall.com Cc: torvalds(a)linux-foundation.org Cc: alan(a)linux.intel.com Link: https://lkml.kernel.org/r/151727413645.33451.15878817161436755393.stgit@dwi… Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- Documentation/speculation.txt | 90 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 90 insertions(+) create mode 100644 Documentation/speculation.txt --- /dev/null +++ b/Documentation/speculation.txt @@ -0,0 +1,90 @@ +This document explains potential effects of speculation, and how undesirable +effects can be mitigated portably using common APIs. + +=========== +Speculation +=========== + +To improve performance and minimize average latencies, many contemporary CPUs +employ speculative execution techniques such as branch prediction, performing +work which may be discarded at a later stage. + +Typically speculative execution cannot be observed from architectural state, +such as the contents of registers. However, in some cases it is possible to +observe its impact on microarchitectural state, such as the presence or +absence of data in caches. Such state may form side-channels which can be +observed to extract secret information. + +For example, in the presence of branch prediction, it is possible for bounds +checks to be ignored by code which is speculatively executed. Consider the +following code: + + int load_array(int *array, unsigned int index) + { + if (index >= MAX_ARRAY_ELEMS) + return 0; + else + return array[index]; + } + +Which, on arm64, may be compiled to an assembly sequence such as: + + CMP <index>, #MAX_ARRAY_ELEMS + B.LT less + MOV <returnval>, #0 + RET + less: + LDR <returnval>, [<array>, <index>] + RET + +It is possible that a CPU mis-predicts the conditional branch, and +speculatively loads array[index], even if index >= MAX_ARRAY_ELEMS. This +value will subsequently be discarded, but the speculated load may affect +microarchitectural state which can be subsequently measured. + +More complex sequences involving multiple dependent memory accesses may +result in sensitive information being leaked. Consider the following +code, building on the prior example: + + int load_dependent_arrays(int *arr1, int *arr2, int index) + { + int val1, val2, + + val1 = load_array(arr1, index); + val2 = load_array(arr2, val1); + + return val2; + } + +Under speculation, the first call to load_array() may return the value +of an out-of-bounds address, while the second call will influence +microarchitectural state dependent on this value. This may provide an +arbitrary read primitive. + +==================================== +Mitigating speculation side-channels +==================================== + +The kernel provides a generic API to ensure that bounds checks are +respected even under speculation. Architectures which are affected by +speculation-based side-channels are expected to implement these +primitives. + +The array_index_nospec() helper in <linux/nospec.h> can be used to +prevent information from being leaked via side-channels. + +A call to array_index_nospec(index, size) returns a sanitized index +value that is bounded to [0, size) even under cpu speculation +conditions. + +This can be used to protect the earlier load_array() example: + + int load_array(int *array, unsigned int index) + { + if (index >= MAX_ARRAY_ELEMS) + return 0; + else { + index = array_index_nospec(index, MAX_ARRAY_ELEMS); + return array[index]; + } + } Patches currently in stable-queue which might be from mark.rutland(a)arm.com are queue-4.9/documentation-document-array_index_nospec.patch

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] [PATCH 4.14 000/159] 4.14.9-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.9 release. There are 159 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Dec 24 08:45:36 UTC 2017. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.9-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.9-rc1 Peter Hutterer <peter.hutterer(a)who-t.net> platform/x86: asus-wireless: send an EV_SYN/SYN_REPORT between state changes Daniel Lezcano <daniel.lezcano(a)linaro.org> thermal/drivers/hisi: Fix multiple alarm interrupts firing Daniel Lezcano <daniel.lezcano(a)linaro.org> thermal/drivers/hisi: Simplify the temperature/step computation Daniel Lezcano <daniel.lezcano(a)linaro.org> thermal/drivers/hisi: Fix kernel panic on alarm interrupt Daniel Lezcano <daniel.lezcano(a)linaro.org> thermal/drivers/hisi: Fix missing interrupt enablement Niranjana Vishwanathapura <niranjana.vishwanathapura(a)intel.com> IB/opa_vnic: Properly return the total MACs in UC MAC list Scott Franco <safranco(a)intel.com> IB/opa_vnic: Properly clear Mac Table Digest Eric Anholt <eric(a)anholt.net> drm/vc4: Avoid using vrefresh==0 mode in DSI htotal math. Nicholas Piggin <npiggin(a)gmail.com> cpuidle: fix broadcast control when broadcast can not be entered Alexandre Belloni <alexandre.belloni(a)free-electrons.com> rtc: set the alarm to the next expiring timer Hoang Tran <tranviethoang.vn(a)gmail.com> tcp: fix under-evaluated ssthresh in TCP Vegas Chen-Yu Tsai <wens(a)csie.org> clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision Arvind Yadav <arvind.yadav.cs(a)gmail.com> staging: greybus: light: Release memory obtained by kasprintf Wei Hu(Xavier) <xavier.huwei(a)huawei.com> RDMA/hns: Avoid NULL pointer exception Mike Manning <mmanning(a)brocade.com> net: ipv6: send NS for DAD when link operationally up Mick Tarsel <mjtarsel(a)linux.vnet.ibm.com> ibmvnic: Set state UP Jacob Keller <jacob.e.keller(a)intel.com> fm10k: ensure we process SM mbx when processing VF mbx Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: exynos_defconfig: Enable UAS support for Odroid HC1 board Alex Williamson <alex.williamson(a)redhat.com> vfio/pci: Virtualize Maximum Payload Size Alan Brady <alan.brady(a)intel.com> i40e: fix client notify of VF reset Dick Kennedy <dick.kennedy(a)broadcom.com> scsi: lpfc: Fix warning messages when NVME_TARGET_FC not defined Dick Kennedy <dick.kennedy(a)broadcom.com> scsi: lpfc: PLOGI failures during NPIV testing Dick Kennedy <dick.kennedy(a)broadcom.com> scsi: lpfc: Fix secure firmware updates Jacob Keller <jacob.e.keller(a)intel.com> fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw Nicolas Dechesne <nicolas.dechesne(a)linaro.org> ASoC: codecs: msm8916-wcd-analog: fix module autoload Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> sctp: silence warns on sctp_stream_init allocations Nicholas Piggin <npiggin(a)gmail.com> powerpc/watchdog: Do not trigger SMP crash from touch_nmi_watchdog Nicholas Piggin <npiggin(a)gmail.com> powerpc/xmon: Avoid tripping SMP hardlockup watchdog Ed Blake <ed.blake(a)sondrel.com> ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback Jean-François Têtu <jean-francois.tetu(a)savoirfairelinux.com> ASoC: codecs: msm8916-wcd-analog: fix micbias level Tom Zanussi <tom.zanussi(a)linux.intel.com> tracing: Exclude 'generic fields' from histograms Gabriele Paoloni <gabriele.paoloni(a)huawei.com> PCI/AER: Report non-fatal errors only to the affected endpoint Jacob Keller <jacob.e.keller(a)intel.com> i40e/i40evf: spread CPU affinity hints across online CPUs only Hans de Goede <hdegoede(a)redhat.com> Bluetooth: hci_bcm: Fix setting of irq trigger type Hans de Goede <hdegoede(a)redhat.com> Bluetooth: hci_uart_set_flow_control: Fix NULL deref when using serdev Andrew Jeffery <andrew(a)aj.id.au> leds: pca955x: Don't invert requested value in pca955x_gpio_set_value() Wei Wang <weiwan(a)google.com> ipv6: grab rt->rt6i_ref before allocating pcpu rt William Tu <u9012063(a)gmail.com> ip_gre: check packet length and mtu correctly in erspan tx Guoqing Jiang <gqjiang(a)suse.com> md: always set THREAD_WAKEUP and wake up wqueue if thread existed Luca Miccio <lucmiccio(a)gmail.com> block,bfq: Disable writeback throttling Colin Ian King <colin.king(a)canonical.com> IB/rxe: check for allocation failure on elem Emil Tantilov <emil.s.tantilov(a)intel.com> ixgbe: fix use of uninitialized padding Lorenzo Bianconi <lorenzo.bianconi83(a)gmail.com> iio: st_sensors: add register mask for status register Lihong Yang <lihong.yang(a)intel.com> i40e: use the safe hash table iterator when deleting mac filters Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> igb: check memory allocation failure Fabio Estevam <fabio.estevam(a)nxp.com> PM / OPP: Move error message to debug level Stuart Hayes <stuart.w.hayes(a)gmail.com> PCI: Create SR-IOV virtfn/physfn links before attaching driver Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive Varun Prakash <varun(a)chelsio.com> scsi: cxgb4i: fix Tx skb leak David Daney <david.daney(a)cavium.com> PCI: Avoid bus reset if bridge itself is broken Dan Murphy <dmurphy(a)ti.com> net: phy: at803x: Change error to EINVAL for invalid MAC Shakeel Butt <shakeelb(a)google.com> kvm, mm: account kvm related kmem slabs to kmemcg Russell King <rmk+kernel(a)armlinux.org.uk> rtc: pl031: make interrupt optional Christophe Jaillet <christophe.jaillet(a)wanadoo.fr> crypto: lrw - Fix an error handling path in 'create()' Christian Lamparter <chunkeey(a)gmail.com> crypto: crypto4xx - increase context and scatter ring buffer elements Chen-Yu Tsai <wens(a)csie.org> clk: sunxi-ng: sun5i: Fix bit offset of audio PLL post-divider Chen-Yu Tsai <wens(a)csie.org> clk: sunxi-ng: nm: Check if requested rate is supported by fractional clock Shashank Sharma <shashank.sharma(a)intel.com> drm: Add retries for lspcon mode detection Derek Basehore <dbasehore(a)chromium.org> backlight: pwm_bl: Fix overflow condition Jens Wiklander <jens.wiklander(a)linaro.org> optee: fix invalid of_node_put() in optee_driver_init() Thomas Gleixner <tglx(a)linutronix.de> x86/cpufeatures: Make CPU bugs sticky Thomas Gleixner <tglx(a)linutronix.de> x86/paravirt: Provide a way to check for hypervisors Thomas Gleixner <tglx(a)linutronix.de> x86/paravirt: Dont patch flush_tlb_single Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Make cpu_entry_area.tss read-only Andy Lutomirski <luto(a)kernel.org> x86/entry: Clean up the SYSENTER_stack code Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Remove the SYSENTER stack canary Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Move the IST stacks into struct cpu_entry_area Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Create a per-CPU SYSCALL entry trampoline Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Return to userspace from the trampoline stack Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Use a per-CPU trampoline stack for IDT entries Andy Lutomirski <luto(a)kernel.org> x86/espfix/64: Stop assuming that pt_regs is on the entry stack Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Separate cpu_current_top_of_stack from TSS.sp0 Andy Lutomirski <luto(a)kernel.org> x86/entry: Remap the TSS into the CPU entry area Andy Lutomirski <luto(a)kernel.org> x86/entry: Move SYSENTER_stack to the beginning of struct tss_struct Andy Lutomirski <luto(a)kernel.org> x86/dumpstack: Handle stack overflow on all stacks Andy Lutomirski <luto(a)kernel.org> x86/entry: Fix assumptions that the HW TSS is at the beginning of cpu_tss Andy Lutomirski <luto(a)kernel.org> x86/kasan/64: Teach KASAN about the cpu_entry_area Andy Lutomirski <luto(a)kernel.org> x86/mm/fixmap: Generalize the GDT fixmap mechanism, introduce struct cpu_entry_area Andy Lutomirski <luto(a)kernel.org> x86/entry/gdt: Put per-CPU GDT remaps in ascending order Andy Lutomirski <luto(a)kernel.org> x86/dumpstack: Add get_stack_info() support for the SYSENTER stack Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Allocate and enable the SYSENTER stack Andy Lutomirski <luto(a)kernel.org> x86/irq/64: Print the offending IP in the stack overflow warning Andy Lutomirski <luto(a)kernel.org> x86/irq: Remove an old outdated comment about context tracking races Josh Poimboeuf <jpoimboe(a)redhat.com> x86/unwinder: Handle stack overflows more gracefully Andy Lutomirski <luto(a)kernel.org> x86/unwinder/orc: Dont bail on stack overflow Boris Ostrovsky <boris.ostrovsky(a)oracle.com> x86/entry/64/paravirt: Use paravirt-safe macro to access eflags Andrey Ryabinin <aryabinin(a)virtuozzo.com> x86/mm/kasan: Don't use vmemmap_populate() to initialize shadow Will Deacon <will.deacon(a)arm.com> locking/barriers: Convert users of lockless_dereference() to READ_ONCE() Will Deacon <will.deacon(a)arm.com> locking/barriers: Add implicit smp_read_barrier_depends() to READ_ONCE() Daniel Borkmann <daniel(a)iogearbox.net> bpf: fix build issues on um due to mising bpf_perf_event.h Andi Kleen <ak(a)linux.intel.com> perf/x86: Enable free running PEBS for REGS_USER/INTR Rudolf Marek <r.marek(a)assembler.cz> x86: Make X86_BUG_FXSAVE_LEAK detectable in CPUID on AMD Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> x86/cpufeature: Add User-Mode Instruction Prevention definitions Ingo Molnar <mingo(a)kernel.org> drivers/misc/intel/pti: Rename the header file to free up the namespace Juergen Gross <jgross(a)suse.com> x86/virt: Add enum for hypervisors to replace x86_hyper Juergen Gross <jgross(a)suse.com> x86/virt, x86/platform: Merge 'struct x86_hyper' into 'struct x86_platform' and 'struct x86_init' James Morse <james.morse(a)arm.com> ACPI / APEI: Replace ioremap_page_range() with fixmap Andy Lutomirski <luto(a)kernel.org> selftests/x86/ldt_gdt: Run most existing LDT test cases against the GDT as well Andy Lutomirski <luto(a)kernel.org> selftests/x86/ldt_gdt: Add infrastructure to test set_thread_area() Ingo Molnar <mingo(a)kernel.org> x86/cpufeatures: Fix various details in the feature definitions Ingo Molnar <mingo(a)kernel.org> x86/cpufeatures: Re-tabulate the X86_FEATURE definitions Borislav Petkov <bp(a)suse.de> x86/mm: Define _PAGE_TABLE using _KERNPG_TABLE Thomas Gleixner <tglx(a)linutronix.de> bitops: Revert cbe96375025e ("bitops: Add clear/set_bit32() to linux/bitops.h") Thomas Gleixner <tglx(a)linutronix.de> x86/cpuid: Replace set/clear_bit32() Borislav Petkov <bp(a)suse.de> x86/entry/64: Shorten TEST instructions Andy Lutomirski <luto(a)kernel.org> x86/traps: Use a new on_thread_stack() helper to clean up an assertion Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Remove thread_struct::sp0 Andy Lutomirski <luto(a)kernel.org> x86/entry/32: Fix cpu_current_top_of_stack initialization at boot Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Remove all remaining direct thread_struct::sp0 reads Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Stop initializing TSS.sp0 at boot Andy Lutomirski <luto(a)kernel.org> x86/xen/64, x86/entry/64: Clean up SP code in cpu_initialize_context() Andy Lutomirski <luto(a)kernel.org> x86/entry: Add task_top_of_stack() to find the top of a task's stack Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Pass SP0 directly to load_sp0() Andy Lutomirski <luto(a)kernel.org> x86/entry/32: Pull the MSR_IA32_SYSENTER_CS update code out of native_load_sp0() Andy Lutomirski <luto(a)kernel.org> x86/entry/64: De-Xen-ify our NMI code Juergen Gross <jgross(a)suse.com> xen, x86/entry/64: Add xen NMI trap entry Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Remove the RESTORE_..._REGS infrastructure Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Use POP instead of MOV to restore regs on NMI return Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Merge the fast and slow SYSRET paths Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Use pop instead of movq in syscall_return_via_sysret Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Shrink paranoid_exit_restore and make labels local Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Simplify reg restore code in the standard IRET paths Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Move SWAPGS into the common IRET-to-usermode path Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Split the IRET-to-user and IRET-to-kernel paths Andy Lutomirski <luto(a)kernel.org> x86/entry/64: Remove the restore_c_regs_and_iret label Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> ptrace,x86: Make user_64bit_mode() available to 32-bit builds Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> x86/boot: Relocate definition of the initial state of CR0 Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> x86/mm: Relocate page fault error codes to traps.h Gayatri Kammela <gayatri.kammela(a)intel.com> x86/cpufeatures: Enable new SSE/AVX/AVX512 CPU features Baoquan He <bhe(a)redhat.com> x86/mm/64: Rename the register_page_bootmem_memmap() 'size' parameter to 'nr_pages' Masahiro Yamada <yamada.masahiro(a)socionext.com> x86/build: Beautify build log of syscall headers Josh Poimboeuf <jpoimboe(a)redhat.com> x86/asm: Don't use the confusing '.ifeq' directive Dongjiu Geng <gengdongjiu(a)huawei.com> ACPI / APEI: remove the unused dead-code for SEA/NMI notification type Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/xen: Drop 5-level paging support code from the XEN_PV code Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/xen: Provide pre-built page tables only for CONFIG_XEN_PV=y and CONFIG_XEN_PVH=y Andrey Ryabinin <aryabinin(a)virtuozzo.com> x86/kasan: Use the same shadow offset for 4- and 5-level paging Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> mm/sparsemem: Allocate mem_section at runtime for CONFIG_SPARSEMEM_EXTREME=y Thomas Gleixner <tglx(a)linutronix.de> x86/cpuid: Prevent out of bound access in do_clear_cpu_cap() Kamalesh Babulal <kamalesh(a)linux.vnet.ibm.com> objtool: Print top level commands on incorrect usage Kees Cook <keescook(a)chromium.org> x86/platform/UV: Convert timers to use timer_setup() Andi Kleen <ak(a)linux.intel.com> x86/fpu: Remove the explicit clearing of XSAVE dependent features Andi Kleen <ak(a)linux.intel.com> x86/fpu: Make XSAVE check the base CPUID features before enabling Andi Kleen <ak(a)linux.intel.com> x86/fpu: Parse clearcpuid= as early XSAVE argument Andi Kleen <ak(a)linux.intel.com> x86/cpuid: Add generic table for CPUID dependencies Andi Kleen <ak(a)linux.intel.com> bitops: Add clear/set_bit32() to linux/bitops.h Josh Poimboeuf <jpoimboe(a)redhat.com> x86/unwind: Make CONFIG_UNWINDER_ORC=y the default in kconfig for 64-bit Josh Poimboeuf <jpoimboe(a)redhat.com> x86/unwind: Rename unwinder config options to 'CONFIG_UNWINDER_*' Steven Rostedt (VMware) <rostedt(a)goodmis.org> x86/fpu/debug: Remove unused 'x86_fpu_state' and 'x86_fpu_deactivate_state' tracepoints Ingo Molnar <mingo(a)kernel.org> x86/unwinder: Make CONFIG_UNWINDER_ORC=y the default in the 64-bit defconfig Jan Beulich <JBeulich(a)suse.com> ACPI / APEI: adjust a local variable type in ghes_ioremap_pfn_irq() Josh Poimboeuf <jpoimboe(a)redhat.com> x86/head: Add unwind hint annotations Josh Poimboeuf <jpoimboe(a)redhat.com> x86/xen: Add unwind hint annotations Josh Poimboeuf <jpoimboe(a)redhat.com> x86/xen: Fix xen head ELF annotations Josh Poimboeuf <jpoimboe(a)redhat.com> x86/boot: Annotate verify_cpu() as a callable function Josh Poimboeuf <jpoimboe(a)redhat.com> x86/head: Fix head ELF function annotations Josh Poimboeuf <jpoimboe(a)redhat.com> x86/head: Remove unused 'bad_address' code Josh Poimboeuf <jpoimboe(a)redhat.com> x86/head: Remove confusing comment Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Don't report end of section error after an empty unwind hint Uros Bizjak <ubizjak(a)gmail.com> x86/asm: Remove unnecessary \n\t in front of CC_SET() from asm templates ------------- Diffstat: Documentation/x86/orc-unwinder.txt | 2 +- Documentation/x86/x86_64/mm.txt | 2 +- Makefile | 8 +- arch/arm/configs/exynos_defconfig | 2 +- arch/arm64/include/asm/fixmap.h | 7 + arch/powerpc/kernel/watchdog.c | 7 +- arch/powerpc/xmon/xmon.c | 17 +- arch/um/include/asm/Kbuild | 1 + arch/x86/Kconfig | 5 +- arch/x86/Kconfig.debug | 39 +- arch/x86/configs/tiny.config | 4 +- arch/x86/configs/x86_64_defconfig | 1 + arch/x86/entry/calling.h | 69 +-- arch/x86/entry/entry_32.S | 6 +- arch/x86/entry/entry_64.S | 322 +++++++++--- arch/x86/entry/entry_64_compat.S | 10 +- arch/x86/entry/syscalls/Makefile | 4 +- arch/x86/events/core.c | 2 +- arch/x86/events/intel/core.c | 4 + arch/x86/events/perf_event.h | 24 +- arch/x86/hyperv/hv_init.c | 2 +- arch/x86/include/asm/archrandom.h | 8 +- arch/x86/include/asm/bitops.h | 10 +- arch/x86/include/asm/compat.h | 1 + arch/x86/include/asm/cpufeature.h | 11 +- arch/x86/include/asm/cpufeatures.h | 538 +++++++++++---------- arch/x86/include/asm/desc.h | 11 +- arch/x86/include/asm/fixmap.h | 74 ++- arch/x86/include/asm/hypervisor.h | 53 +- arch/x86/include/asm/irqflags.h | 3 + arch/x86/include/asm/kdebug.h | 1 + arch/x86/include/asm/mmu_context.h | 4 +- arch/x86/include/asm/module.h | 2 +- arch/x86/include/asm/paravirt.h | 14 +- arch/x86/include/asm/paravirt_types.h | 2 +- arch/x86/include/asm/percpu.h | 2 +- arch/x86/include/asm/pgtable_types.h | 3 +- arch/x86/include/asm/processor.h | 109 +++-- arch/x86/include/asm/ptrace.h | 6 +- arch/x86/include/asm/rmwcc.h | 2 +- arch/x86/include/asm/stacktrace.h | 3 + arch/x86/include/asm/switch_to.h | 26 + arch/x86/include/asm/thread_info.h | 2 +- arch/x86/include/asm/trace/fpu.h | 10 - arch/x86/include/asm/traps.h | 21 +- arch/x86/include/asm/unwind.h | 15 +- arch/x86/include/asm/x86_init.h | 24 + arch/x86/include/uapi/asm/processor-flags.h | 3 + arch/x86/kernel/Makefile | 10 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 5 +- arch/x86/kernel/asm-offsets.c | 6 + arch/x86/kernel/asm-offsets_32.c | 9 +- arch/x86/kernel/asm-offsets_64.c | 4 + arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/amd.c | 7 +- arch/x86/kernel/cpu/common.c | 195 +++++--- arch/x86/kernel/cpu/cpuid-deps.c | 121 +++++ arch/x86/kernel/cpu/hypervisor.c | 64 +-- arch/x86/kernel/cpu/mshyperv.c | 6 +- arch/x86/kernel/cpu/vmware.c | 8 +- arch/x86/kernel/doublefault.c | 36 +- arch/x86/kernel/dumpstack.c | 74 ++- arch/x86/kernel/dumpstack_32.c | 6 + arch/x86/kernel/dumpstack_64.c | 6 + arch/x86/kernel/fpu/init.c | 11 + arch/x86/kernel/fpu/xstate.c | 43 +- arch/x86/kernel/head_32.S | 5 +- arch/x86/kernel/head_64.S | 45 +- arch/x86/kernel/ioport.c | 2 +- arch/x86/kernel/irq.c | 12 - arch/x86/kernel/irq_64.c | 4 +- arch/x86/kernel/kvm.c | 6 +- arch/x86/kernel/ldt.c | 2 +- arch/x86/kernel/paravirt_patch_64.c | 2 - arch/x86/kernel/process.c | 27 +- arch/x86/kernel/process_32.c | 8 +- arch/x86/kernel/process_64.c | 19 +- arch/x86/kernel/smpboot.c | 3 +- arch/x86/kernel/traps.c | 72 +-- arch/x86/kernel/unwind_orc.c | 88 ++-- arch/x86/kernel/verify_cpu.S | 3 +- arch/x86/kernel/vm86_32.c | 20 +- arch/x86/kernel/vmlinux.lds.S | 9 + arch/x86/kernel/x86_init.c | 9 + arch/x86/kvm/mmu.c | 4 +- arch/x86/kvm/vmx.c | 2 +- arch/x86/lib/delay.c | 4 +- arch/x86/mm/fault.c | 88 ++-- arch/x86/mm/init.c | 2 +- arch/x86/mm/init_64.c | 10 +- arch/x86/mm/kasan_init_64.c | 262 ++++++++-- arch/x86/power/cpu.c | 16 +- arch/x86/xen/enlighten_hvm.c | 12 +- arch/x86/xen/enlighten_pv.c | 15 +- arch/x86/xen/mmu_pv.c | 161 +++--- arch/x86/xen/smp_pv.c | 17 +- arch/x86/xen/xen-asm_64.S | 2 +- arch/x86/xen/xen-head.S | 11 +- block/bfq-iosched.c | 3 +- block/blk-wbt.c | 2 +- crypto/lrw.c | 6 +- drivers/acpi/apei/ghes.c | 78 +-- drivers/base/power/opp/core.c | 2 +- drivers/bluetooth/hci_bcm.c | 23 +- drivers/bluetooth/hci_ldisc.c | 7 + drivers/clk/sunxi-ng/ccu-sun5i.c | 4 +- drivers/clk/sunxi-ng/ccu-sun6i-a31.c | 2 +- drivers/clk/sunxi-ng/ccu_nm.c | 3 + drivers/cpuidle/cpuidle.c | 1 + drivers/crypto/amcc/crypto4xx_core.h | 10 +- drivers/gpu/drm/drm_dp_dual_mode_helper.c | 16 +- drivers/gpu/drm/vc4/vc4_dsi.c | 3 +- drivers/hv/vmbus_drv.c | 2 +- drivers/iio/accel/st_accel_core.c | 35 +- drivers/iio/common/st_sensors/st_sensors_core.c | 2 +- drivers/iio/common/st_sensors/st_sensors_trigger.c | 16 +- drivers/iio/gyro/st_gyro_core.c | 15 +- drivers/iio/magnetometer/st_magn_core.c | 10 +- drivers/iio/pressure/st_pressure_core.c | 15 +- drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 5 + drivers/infiniband/sw/rxe/rxe_pool.c | 2 + drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c | 1 + .../infiniband/ulp/opa_vnic/opa_vnic_vema_iface.c | 8 +- drivers/input/mouse/vmmouse.c | 10 +- drivers/leds/leds-pca955x.c | 17 +- drivers/md/dm-mpath.c | 20 +- drivers/md/md.c | 4 +- drivers/misc/pti.c | 2 +- drivers/misc/vmw_balloon.c | 2 +- drivers/net/ethernet/ibm/ibmvnic.c | 2 + drivers/net/ethernet/intel/fm10k/fm10k.h | 4 +- drivers/net/ethernet/intel/fm10k/fm10k_iov.c | 12 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 16 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 7 +- drivers/net/ethernet/intel/i40evf/i40evf_main.c | 9 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 + drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 2 + drivers/net/phy/at803x.c | 2 +- drivers/pci/iov.c | 3 +- drivers/pci/pci.c | 4 + drivers/pci/pcie/aer/aerdrv_core.c | 9 +- drivers/platform/x86/asus-wireless.c | 1 + drivers/rtc/interface.c | 2 +- drivers/rtc/rtc-pl031.c | 14 +- drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 1 + drivers/scsi/lpfc/lpfc_hbadisc.c | 3 +- drivers/scsi/lpfc/lpfc_hw4.h | 2 +- drivers/scsi/lpfc/lpfc_nvmet.c | 2 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 5 + drivers/staging/greybus/light.c | 2 + drivers/tee/optee/core.c | 1 - drivers/thermal/hisi_thermal.c | 74 ++- drivers/vfio/pci/vfio_pci_config.c | 6 +- drivers/video/backlight/pwm_bl.c | 7 +- fs/dcache.c | 4 +- fs/overlayfs/ovl_entry.h | 2 +- fs/overlayfs/readdir.c | 2 +- include/asm-generic/vmlinux.lds.h | 2 +- include/linux/compiler.h | 1 + include/linux/hypervisor.h | 8 +- include/linux/iio/common/st_sensors.h | 7 +- include/linux/{pti.h => intel-pti.h} | 6 +- include/linux/mm.h | 2 +- include/linux/mmzone.h | 6 +- include/linux/rculist.h | 4 +- include/linux/rcupdate.h | 4 +- kernel/events/core.c | 4 +- kernel/seccomp.c | 2 +- kernel/task_work.c | 2 +- kernel/trace/trace_events_hist.c | 4 +- lib/Kconfig.debug | 2 +- mm/page_alloc.c | 10 + mm/slab.h | 2 +- mm/sparse.c | 17 +- net/ipv4/ip_gre.c | 8 +- net/ipv4/tcp_vegas.c | 2 +- net/ipv6/addrconf.c | 12 +- net/ipv6/route.c | 58 +-- net/sctp/stream.c | 8 +- scripts/Makefile.build | 2 +- sound/soc/codecs/msm8916-wcd-analog.c | 9 +- sound/soc/img/img-parallel-out.c | 2 + tools/objtool/check.c | 7 +- tools/objtool/objtool.c | 6 +- tools/testing/selftests/x86/ldt_gdt.c | 61 ++- virt/kvm/kvm_main.c | 2 +- 188 files changed, 2414 insertions(+), 1428 deletions(-)

6 years, 11 months

19
229
0 0

[Linux-stable-mirror] Patch "x86/retpoline: Remove the esp/rsp thunk" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled x86/retpoline: Remove the esp/rsp thunk to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: x86-retpoline-remove-the-esp-rsp-thunk.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Wed Feb 7 19:38:23 CST 2018 From: Waiman Long <longman(a)redhat.com> Date: Mon, 22 Jan 2018 17:09:34 -0500 Subject: x86/retpoline: Remove the esp/rsp thunk From: Waiman Long <longman(a)redhat.com> (cherry picked from commit 1df37383a8aeabb9b418698f0bcdffea01f4b1b2) It doesn't make sense to have an indirect call thunk with esp/rsp as retpoline code won't work correctly with the stack pointer register. Removing it will help compiler writers to catch error in case such a thunk call is emitted incorrectly. Fixes: 76b043848fd2 ("x86/retpoline: Add initial retpoline support") Suggested-by: Jeff Law <law(a)redhat.com> Signed-off-by: Waiman Long <longman(a)redhat.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: David Woodhouse <dwmw(a)amazon.co.uk> Cc: Tom Lendacky <thomas.lendacky(a)amd.com> Cc: Kees Cook <keescook(a)google.com> Cc: Andi Kleen <ak(a)linux.intel.com> Cc: Tim Chen <tim.c.chen(a)linux.intel.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Jiri Kosina <jikos(a)kernel.org> Cc: Andy Lutomirski <luto(a)amacapital.net> Cc: Dave Hansen <dave.hansen(a)intel.com> Cc: Josh Poimboeuf <jpoimboe(a)redhat.com> Cc: Arjan van de Ven <arjan(a)linux.intel.com> Cc: Greg Kroah-Hartman <gregkh(a)linux-foundation.org> Cc: Paul Turner <pjt(a)google.com> Link: https://lkml.kernel.org/r/1516658974-27852-1-git-send-email-longman@redhat.… Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- arch/x86/include/asm/asm-prototypes.h | 1 - arch/x86/lib/retpoline.S | 1 - 2 files changed, 2 deletions(-) --- a/arch/x86/include/asm/asm-prototypes.h +++ b/arch/x86/include/asm/asm-prototypes.h @@ -37,5 +37,4 @@ INDIRECT_THUNK(dx) INDIRECT_THUNK(si) INDIRECT_THUNK(di) INDIRECT_THUNK(bp) -INDIRECT_THUNK(sp) #endif /* CONFIG_RETPOLINE */ --- a/arch/x86/lib/retpoline.S +++ b/arch/x86/lib/retpoline.S @@ -36,7 +36,6 @@ GENERATE_THUNK(_ASM_DX) GENERATE_THUNK(_ASM_SI) GENERATE_THUNK(_ASM_DI) GENERATE_THUNK(_ASM_BP) -GENERATE_THUNK(_ASM_SP) #ifdef CONFIG_64BIT GENERATE_THUNK(r8) GENERATE_THUNK(r9) Patches currently in stable-queue which might be from longman(a)redhat.com are queue-4.9/x86-retpoline-remove-the-esp-rsp-thunk.patch

6 years, 11 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror February 2018