From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit 2641f08bb7fc63a636a2b18173221d7040a3512e upstream.
Convert indirect jumps in core 32/64bit entry assembler code to use
non-speculative sequences when CONFIG_RETPOLINE is enabled.
Don't use CALL_NOSPEC in entry_SYSCALL_64_fastpath because the return
address after the 'call' instruction must be *precisely* at the
.Lentry_SYSCALL_64_after_fastpath label for stub_ptregs_64 to work,
and the use of alternatives will mess that up unless we play horrid
games to prepend with NOPs and make the variants the same length. It's
not worth it; in the case where we ALTERNATIVE out the retpoline, the
first instruction at __x86.indirect_thunk.rax is going to be a bare
jmp *%rax anyway.
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Arjan van de Ven <redacted>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Josh Poimboeuf <redacted>
Cc: thomas.lendacky@amd.com
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Tim Chen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/1515707194-20531-7-git-send-email-dwmw@amazon.co.uk
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Razvan Ghitulete <redacted>
[bwh: Backported to 3.2: adjust filenames, context]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit b9e705ef7cfaf22db0daab91ad3cd33b0fa32eb9 upstream.
Where an ALTERNATIVE is used in the middle of an inline asm block, this
would otherwise lead to the following instruction being appended directly
to the trailing ".popsection", and a failed compile.
Fixes: 9cebed423c84 ("x86, alternative: Use .pushsection/.popsection")
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: ak@linux.intel.com
Cc: Tim Chen <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Paul Turner <redacted>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Link: https://lkml.kernel.org/r/20180104143710.8961-8-dwmw@amazon.co.uk
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/alternative.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit 2961298efe1ea1b6fc0d7ee8b76018fa6c0bcef2 upstream.
We want to expose the hardware features simply in /proc/cpuinfo as "ibrs",
"ibpb" and "stibp". Since AMD has separate CPUID bits for those, use them
as the user-visible bits.
When the Intel SPEC_CTRL bit is set which indicates both IBRS and IBPB
capability, set those (AMD) bits accordingly. Likewise if the Intel STIBP
bit is set, set the AMD STIBP that's used for the generic hardware
capability.
Hide the rest from /proc/cpuinfo by putting "" in the comments. Including
RETPOLINE and RETPOLINE_AMD which shouldn't be visible there. There are
patches to make the sysfs vulnerabilities information non-readable by
non-root, and the same should apply to all information about which
mitigations are actually in use. Those *shouldn't* appear in /proc/cpuinfo.
The feature bit for whether IBPB is actually used, which is needed for
ALTERNATIVEs, is renamed to X86_FEATURE_USE_IBPB.
Originally-by: Borislav Petkov [off-list ref]
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: ak@linux.intel.com
Cc: dave.hansen@intel.com
Cc: karahmed@amazon.de
Cc: arjan@linux.intel.com
Cc: torvalds@linux-foundation.org
Cc: peterz@infradead.org
Cc: bp@alien8.de
Cc: pbonzini@redhat.com
Cc: tim.c.chen@linux.intel.com
Cc: gregkh@linux-foundation.org
Link: https://lkml.kernel.org/r/1517070274-12128-2-git-send-email-dwmw@amazon.co.uk
[bwh: For 3.2, just apply the part that hides fake CPU feature bits]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <redacted>
commit de791821c295cc61419a06fe5562288417d1bc58 upstream.
Use the name associated with the particular attack which needs page table
isolation for mitigation.
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: David Woodhouse <redacted>
Cc: Alan Cox <redacted>
Cc: Jiri Koshina <jikos@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Tim Chen <redacted>
Cc: Andi Lutomirski <luto@amacapital.net>
Cc: Andi Kleen <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Paul Turner <redacted>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Greg KH <gregkh@linux-foundation.org>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1801051525300.1724@nanos
[bwh: Backported to 3.2: bug number is different]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <redacted>
commit 612e8e9350fd19cae6900cf36ea0c6892d1a0dca upstream.
The alternatives code checks only the first byte whether it is a NOP, but
with NOPs in front of the payload and having actual instructions after it
breaks the "optimized' test.
Make sure to scan all bytes before deciding to optimize the NOPs in there.
Reported-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Borislav Petkov <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Andi Kleen <redacted>
Cc: Tim Chen <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Dave Hansen <redacted>
Cc: Andi Kleen <redacted>
Cc: Andrew Lutomirski <luto@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/20180110112815.mgciyf5acwacphkq@pd.tnic
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/kernel/alternative.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dave Hansen <dave.hansen@linux.intel.com>
commit 01c9b17bf673b05bb401b76ec763e9730ccf1376 upstream.
Add some details about how PTI works, what some of the downsides
are, and how to debug it when things go wrong.
Also document the kernel parameter: 'pti/nopti'.
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Thomas Gleixner <redacted>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Kees Cook <redacted>
Cc: Moritz Lipp <redacted>
Cc: Daniel Gruss <redacted>
Cc: Michael Schwarz <redacted>
Cc: Richard Fellner <redacted>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Andi Lutomirsky <luto@kernel.org>
Link: https://lkml.kernel.org/r/20180105174436.1BC6FA2B@viggo.jf.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
Documentation//kernel-parameters.txt | 21 ++-
Documentation/x86/pti.txt | 186 ++++++++++++++++++++++++
2 files changed, 200 insertions(+), 7 deletions(-)
create mode 100644 Documentation/x86/pti.txt
@@ -1803,8 +1803,6 @@ bytes respectively. Such letter suffixes nojitter [IA-64] Disables jitter checking for ITC timers.- nopti [X86-64] Disable KAISER isolation of kernel from user.- no-kvmclock [X86,KVM] Disable paravirtualized KVM clock driver no-kvmapf [X86,KVM] Disable paravirtualized asynchronous page
@@ -2245,11 +2243,20 @@ bytes respectively. Such letter suffixes pt. [PARIDE] See Documentation/blockdev/paride.txt.- pti= [X86_64]- Control KAISER user/kernel address space isolation:- on - enable- off - disable- auto - default setting+ pti= [X86_64] Control Page Table Isolation of user and+ kernel address spaces. Disabling this feature+ removes hardening, but improves performance of+ system calls and interrupts.++ on - unconditionally enable+ off - unconditionally disable+ auto - kernel detects whether your CPU model is+ vulnerable to issues that PTI mitigates++ Not specifying this option is equivalent to pti=auto.++ nopti [X86_64]+ Equivalent to pti=off pty.legacy_count= [KNL] Number of legacy pty's. Overwrites compiled-in--- /dev/null+++ b/Documentation/x86/pti.txt
@@ -0,0 +1,186 @@+Overview+========++Page Table Isolation (pti, previously known as KAISER[1]) is a+countermeasure against attacks on the shared user/kernel address+space such as the "Meltdown" approach[2].++To mitigate this class of attacks, we create an independent set of+page tables for use only when running userspace applications. When+the kernel is entered via syscalls, interrupts or exceptions, the+page tables are switched to the full "kernel" copy. When the system+switches back to user mode, the user copy is used again.++The userspace page tables contain only a minimal amount of kernel+data: only what is needed to enter/exit the kernel such as the+entry/exit functions themselves and the interrupt descriptor table+(IDT). There are a few strictly unnecessary things that get mapped+such as the first C function when entering an interrupt (see+comments in pti.c).++This approach helps to ensure that side-channel attacks leveraging+the paging structures do not function when PTI is enabled. It can be+enabled by setting CONFIG_PAGE_TABLE_ISOLATION=y at compile time.+Once enabled at compile-time, it can be disabled at boot with the+'nopti' or 'pti=' kernel parameters (see kernel-parameters.txt).++Page Table Management+=====================++When PTI is enabled, the kernel manages two sets of page tables.+The first set is very similar to the single set which is present in+kernels without PTI. This includes a complete mapping of userspace+that the kernel can use for things like copy_to_user().++Although _complete_, the user portion of the kernel page tables is+crippled by setting the NX bit in the top level. This ensures+that any missed kernel->user CR3 switch will immediately crash+userspace upon executing its first instruction.++The userspace page tables map only the kernel data needed to enter+and exit the kernel. This data is entirely contained in the 'struct+cpu_entry_area' structure which is placed in the fixmap which gives+each CPU's copy of the area a compile-time-fixed virtual address.++For new userspace mappings, the kernel makes the entries in its+page tables like normal. The only difference is when the kernel+makes entries in the top (PGD) level. In addition to setting the+entry in the main kernel PGD, a copy of the entry is made in the+userspace page tables' PGD.++This sharing at the PGD level also inherently shares all the lower+layers of the page tables. This leaves a single, shared set of+userspace page tables to manage. One PTE to lock, one set of+accessed bits, dirty bits, etc...++Overhead+========++Protection against side-channel attacks is important. But,+this protection comes at a cost:++1. Increased Memory Use+ a. Each process now needs an order-1 PGD instead of order-0.+ (Consumes an additional 4k per process).+ b. The 'cpu_entry_area' structure must be 2MB in size and 2MB+ aligned so that it can be mapped by setting a single PMD+ entry. This consumes nearly 2MB of RAM once the kernel+ is decompressed, but no space in the kernel image itself.++2. Runtime Cost+ a. CR3 manipulation to switch between the page table copies+ must be done at interrupt, syscall, and exception entry+ and exit (it can be skipped when the kernel is interrupted,+ though.) Moves to CR3 are on the order of a hundred+ cycles, and are required at every entry and exit.+ b. A "trampoline" must be used for SYSCALL entry. This+ trampoline depends on a smaller set of resources than the+ non-PTI SYSCALL entry code, so requires mapping fewer+ things into the userspace page tables. The downside is+ that stacks must be switched at entry time.+ d. Global pages are disabled for all kernel structures not+ mapped into both kernel and userspace page tables. This+ feature of the MMU allows different processes to share TLB+ entries mapping the kernel. Losing the feature means more+ TLB misses after a context switch. The actual loss of+ performance is very small, however, never exceeding 1%.+ d. Process Context IDentifiers (PCID) is a CPU feature that+ allows us to skip flushing the entire TLB when switching page+ tables by setting a special bit in CR3 when the page tables+ are changed. This makes switching the page tables (at context+ switch, or kernel entry/exit) cheaper. But, on systems with+ PCID support, the context switch code must flush both the user+ and kernel entries out of the TLB. The user PCID TLB flush is+ deferred until the exit to userspace, minimizing the cost.+ See intel.com/sdm for the gory PCID/INVPCID details.+ e. The userspace page tables must be populated for each new+ process. Even without PTI, the shared kernel mappings+ are created by copying top-level (PGD) entries into each+ new process. But, with PTI, there are now *two* kernel+ mappings: one in the kernel page tables that maps everything+ and one for the entry/exit structures. At fork(), we need to+ copy both.+ f. In addition to the fork()-time copying, there must also+ be an update to the userspace PGD any time a set_pgd() is done+ on a PGD used to map userspace. This ensures that the kernel+ and userspace copies always map the same userspace+ memory.+ g. On systems without PCID support, each CR3 write flushes+ the entire TLB. That means that each syscall, interrupt+ or exception flushes the TLB.+ h. INVPCID is a TLB-flushing instruction which allows flushing+ of TLB entries for non-current PCIDs. Some systems support+ PCIDs, but do not support INVPCID. On these systems, addresses+ can only be flushed from the TLB for the current PCID. When+ flushing a kernel address, we need to flush all PCIDs, so a+ single kernel address flush will require a TLB-flushing CR3+ write upon the next use of every PCID.++Possible Future Work+====================+1. We can be more careful about not actually writing to CR3+ unless its value is actually changed.+2. Allow PTI to be enabled/disabled at runtime in addition to the+ boot-time switching.++Testing+========++To test stability of PTI, the following test procedure is recommended,+ideally doing all of these in parallel:++1. Set CONFIG_DEBUG_ENTRY=y+2. Run several copies of all of the tools/testing/selftests/x86/ tests+ (excluding MPX and protection_keys) in a loop on multiple CPUs for+ several minutes. These tests frequently uncover corner cases in the+ kernel entry code. In general, old kernels might cause these tests+ themselves to crash, but they should never crash the kernel.+3. Run the 'perf' tool in a mode (top or record) that generates many+ frequent performance monitoring non-maskable interrupts (see "NMI"+ in /proc/interrupts). This exercises the NMI entry/exit code which+ is known to trigger bugs in code paths that did not expect to be+ interrupted, including nested NMIs. Using "-c" boosts the rate of+ NMIs, and using two -c with separate counters encourages nested NMIs+ and less deterministic behavior.++ while true; do perf record -c 10000 -e instructions,cycles -a sleep 10; done++4. Launch a KVM virtual machine.+5. Run 32-bit binaries on systems supporting the SYSCALL instruction.+ This has been a lightly-tested code path and needs extra scrutiny.++Debugging+=========++Bugs in PTI cause a few different signatures of crashes+that are worth noting here.++ * Failures of the selftests/x86 code. Usually a bug in one of the+ more obscure corners of entry_64.S+ * Crashes in early boot, especially around CPU bringup. Bugs+ in the trampoline code or mappings cause these.+ * Crashes at the first interrupt. Caused by bugs in entry_64.S,+ like screwing up a page table switch. Also caused by+ incorrectly mapping the IRQ handler entry code.+ * Crashes at the first NMI. The NMI code is separate from main+ interrupt handlers and can have bugs that do not affect+ normal interrupts. Also caused by incorrectly mapping NMI+ code. NMIs that interrupt the entry code must be very+ careful and can be the cause of crashes that show up when+ running perf.+ * Kernel crashes at the first exit to userspace. entry_64.S+ bugs, or failing to map some of the exit code.+ * Crashes at first interrupt that interrupts userspace. The paths+ in entry_64.S that return to userspace are sometimes separate+ from the ones that return to the kernel.+ * Double faults: overflowing the kernel stack because of page+ faults upon page faults. Caused by touching non-pti-mapped+ data in the entry code, or forgetting to switch to kernel+ CR3 before calling into C functions which are not pti-mapped.+ * Userspace segfaults early in boot, sometimes manifesting+ as mount(8) failing to mount the rootfs. These have+ tended to be TLB invalidation issues. Usually invalidating+ the wrong PCID, or otherwise missing an invalidation.++1. https://gruss.cc/files/kaiser.pdf+2. https://meltdownattack.com/meltdown.pdf
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit 99c6fa2511d8a683e61468be91b83f85452115fa upstream.
Add the bug bits for spectre v1/2 and force them unconditionally for all
cpus.
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Tim Chen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/1515239374-23361-2-git-send-email-dwmw@amazon.co.uk
[bwh: Backported to 3.2: assign the first available bug numbers]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/cpufeature.h | 2 ++
arch/x86/kernel/cpu/common.c | 3 +++
2 files changed, 5 insertions(+)
@@ -215,6 +215,8 @@#define X86_BUG(x) (NCAPINTS*32 + (x))#define X86_BUG_CPU_MELTDOWN X86_BUG(0) /* CPU is affected by meltdown attack and needs kernel page table isolation */+#define X86_BUG_SPECTRE_V1 X86_BUG(1) /* CPU is affected by Spectre variant 1 attack with conditional branches */+#define X86_BUG_SPECTRE_V2 X86_BUG(2) /* CPU is affected by Spectre variant 2 attack with indirect branches */#if defined(__KERNEL__) && !defined(__ASSEMBLY__)---a/arch/x86/kernel/cpu/common.c+++b/arch/x86/kernel/cpu/common.c
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit 304ec1b050310548db33063e567123fae8fd0301 upstream.
Quoting Linus:
I do think that it would be a good idea to very expressly document
the fact that it's not that the user access itself is unsafe. I do
agree that things like "get_user()" want to be protected, but not
because of any direct bugs or problems with get_user() and friends,
but simply because get_user() is an excellent source of a pointer
that is obviously controlled from a potentially attacking user
space. So it's a prime candidate for then finding _subsequent_
accesses that can then be used to perturb the cache.
__uaccess_begin_nospec() covers __get_user() and copy_from_iter() where the
limit check is far away from the user pointer de-reference. In those cases
a barrier_nospec() prevents speculation with a potential pointer to
privileged memory. uaccess_try_nospec covers get_user_try.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Suggested-by: Andi Kleen <redacted>
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: linux-arch@vger.kernel.org
Cc: Kees Cook <redacted>
Cc: kernel-hardening@lists.openwall.com
Cc: gregkh@linuxfoundation.org
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727416953.33451.10508284228526170604.stgit@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2:
- There's no SMAP support, so use barrier_nospec() directly instead of
__uaccess_begin_nospec()
- Convert several more functions to use barrier_nospec(), that are just
wrappers in mainline
- There's no 'case 8' in __copy_to_user_inatomic()
- Adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit da285121560e769cc31797bba6422eea71d473e0 upstream.
Add a spectre_v2= option to select the mitigation used for the indirect
branch speculation vulnerability.
Currently, the only option available is retpoline, in its various forms.
This will be expanded to cover the new IBRS/IBPB microcode features.
The RETPOLINE_AMD feature relies on a serializing LFENCE for speculation
control. For AMD hardware, only set RETPOLINE_AMD if LFENCE is a
serializing instruction, which is indicated by the LFENCE_RDTSC feature.
[ tglx: Folded back the LFENCE/AMD fixes and reworked it so IBRS
integration becomes simple ]
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Josh Poimboeuf <redacted>
Cc: thomas.lendacky@amd.com
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Tim Chen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/1515707194-20531-5-git-send-email-dwmw@amazon.co.uk
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <redacted>
---
Documentation/kernel-parameters.txt | 28 +++++
arch/x86/include/asm/nospec-branch.h | 10 ++
arch/x86/kernel/cpu/bugs.c | 158 +++++++++++++++++++++++-
arch/x86/kernel/cpu/common.c | 4 -
4 files changed, 195 insertions(+), 5 deletions(-)
@@ -1753,6 +1753,11 @@ bytes respectively. Such letter suffixes register save and restore. The kernel will only save legacy floating-point registers on task switch.+ nospectre_v2 [X86] Disable all mitigations for the Spectre variant 2+ (indirect branch prediction) vulnerability. System may+ allow data leaks with this option, which is equivalent+ to spectre_v2=off.+ noxsave [BUGS=X86] Disables x86 extended register state save and restore using xsave. The kernel will fallback to enabling legacy floating-point and sse state.
@@ -2468,6 +2473,29 @@ bytes respectively. Such letter suffixes specialix= [HW,SERIAL] Specialix multi-serial port adapter See Documentation/serial/specialix.txt.+ spectre_v2= [X86] Control mitigation of Spectre variant 2+ (indirect branch speculation) vulnerability.++ on - unconditionally enable+ off - unconditionally disable+ auto - kernel detects whether your CPU model is+ vulnerable++ Selecting 'on' will, and 'auto' may, choose a+ mitigation method at run time according to the+ CPU, the available microcode, the setting of the+ CONFIG_RETPOLINE configuration option, and the+ compiler with which the kernel was built.++ Specific mitigations can also be selected manually:++ retpoline - replace indirect branches+ retpoline,generic - google's original retpoline+ retpoline,amd - AMD-specific minimal thunk++ Not specifying this option is equivalent to+ spectre_v2=auto.+ spia_io_base= [HW,MTD] spia_fio_base= spia_pedr=--- a/arch/x86/include/asm/nospec-branch.h+++ b/arch/x86/include/asm/nospec-branch.h
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit b3d7ad85b80bbc404635dca80f5b129f6242bc7a upstream.
Rename the open coded form of this instruction sequence from
rdtsc_ordered() into a generic barrier primitive, barrier_nospec().
One of the mitigations for Spectre variant1 vulnerabilities is to fence
speculative execution after successfully validating a bounds check. I.e.
force the result of a bounds check to resolve in the instruction pipeline
to ensure speculative execution honors that result before potentially
operating on out-of-bounds data.
No functional changes.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Suggested-by: Andi Kleen <redacted>
Suggested-by: Ingo Molnar <mingo@redhat.com>
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: linux-arch@vger.kernel.org
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Kees Cook <redacted>
Cc: kernel-hardening@lists.openwall.com
Cc: gregkh@linuxfoundation.org
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727415361.33451.9049453007262764675.stgit@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2: update rdtsc_barrier() instead of rdtsc_ordered()]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <redacted>
commit 6cbd2171e89b13377261d15e64384df60ecb530e upstream.
There is currently no way to force CPU bug bits like CPU feature bits. That
makes it impossible to set a bug bit once at boot and have it stick for all
upcoming CPUs.
Extend the force set/clear arrays to handle bug bits as well.
Signed-off-by: Thomas Gleixner <redacted>
Reviewed-by: Borislav Petkov <redacted>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <redacted>
Cc: Brian Gerst <redacted>
Cc: Dave Hansen <redacted>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Laight <redacted>
Cc: Denys Vlasenko <redacted>
Cc: Eduardo Valentin <redacted>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <redacted>
Cc: Juergen Gross <jgross@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <redacted>
Cc: Will Deacon <redacted>
Cc: aliguori@amazon.com
Cc: daniel.gruss@iaik.tugraz.at
Cc: hughd@google.com
Cc: keescook@google.com
Link: https://lkml.kernel.org/r/20171204150606.992156574@linutronix.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/cpufeature.h | 2 ++
arch/x86/include/asm/processor.h | 4 ++--
arch/x86/kernel/cpu/common.c | 6 +++---
3 files changed, 7 insertions(+), 5 deletions(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <thomas.lendacky@amd.com>
commit e4d0e84e490790798691aaa0f2e598637f1867ec upstream.
To aid in speculation control, make LFENCE a serializing instruction
since it has less overhead than MFENCE. This is done by setting bit 1
of MSR 0xc0011029 (DE_CFG). Some families that support LFENCE do not
have this MSR. For these families, the LFENCE instruction is already
serializing.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Thomas Gleixner <redacted>
Reviewed-by: Reviewed-by: Borislav Petkov <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tim Chen <redacted>
Cc: Dave Hansen <redacted>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <redacted>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: David Woodhouse <redacted>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/20180108220921.12580.71694.stgit@tlendack-t1.amdoffice.net
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/msr-index.h | 2 ++
arch/x86/kernel/cpu/amd.c | 10 ++++++++++
2 files changed, 12 insertions(+)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit babdde2698d482b6c0de1eab4f697cf5856c5859 upstream.
array_index_nospec() uses a mask to sanitize user controllable array
indexes, i.e. generate a 0 mask if 'index' >= 'size', and a ~0 mask
otherwise. While the default array_index_mask_nospec() handles the
carry-bit from the (index - size) result in software.
The x86 array_index_mask_nospec() does the same, but the carry-bit is
handled in the processor CF flag without conditional instructions in the
control flow.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: linux-arch@vger.kernel.org
Cc: kernel-hardening@lists.openwall.com
Cc: gregkh@linuxfoundation.org
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727414808.33451.1873237130672785331.stgit@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/system.h | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <redacted>
commit 87590ce6e373d1a5401f6539f0c59ef92dd924a9 upstream.
As the meltdown/spectre problem affects several CPU architectures, it makes
sense to have common way to express whether a system is affected by a
particular vulnerability or not. If affected the way to express the
mitigation should be common as well.
Create /sys/devices/system/cpu/vulnerabilities folder and files for
meltdown, spectre_v1 and spectre_v2.
Allow architectures to override the show function.
Signed-off-by: Thomas Gleixner <redacted>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Konrad Rzeszutek Wilk <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <redacted>
Cc: Dave Hansen <redacted>
Cc: Linus Torvalds <torvalds@linuxfoundation.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: David Woodhouse <redacted>
Link: https://lkml.kernel.org/r/20180107214913.096657732@linutronix.de
[bwh: Backported to 3.2: CPU device class is a sysdev_class, not a normal device
class]
Signed-off-by: Ben Hutchings <redacted>
---
Documentation/ABI/testing/sysfs-devices-system-cpu | 16 ++++++++
drivers/base/Kconfig | 3 ++
drivers/base/cpu.c | 48 ++++++++++++++++++++++
include/linux/cpu.h | 7 ++++
4 files changed, 74 insertions(+)
@@ -201,3 +201,19 @@ Description: Disable L3 cache indices All AMD processors with L3 caches provide this functionality. For details, see BKDGs at http://developer.amd.com/documentation/guides/Pages/default.aspx++What: /sys/devices/system/cpu/vulnerabilities+ /sys/devices/system/cpu/vulnerabilities/meltdown+ /sys/devices/system/cpu/vulnerabilities/spectre_v1+ /sys/devices/system/cpu/vulnerabilities/spectre_v2+Date: Januar 2018+Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>+Description: Information about CPU vulnerabilities++ The files are named after the code names of CPU+ vulnerabilities. The output of those files reflects the+ state of the CPUs in the system. Possible output values:++ "Not affected" CPU is not affected by the vulnerability+ "Vulnerable" CPU is affected and no mitigation in effect+ "Mitigation: $M" CPU is affetcted and mitigation $M is in effect--- a/drivers/base/Kconfig+++ b/drivers/base/Kconfig
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit f3804203306e098dae9ca51540fcd5eb700d7f40 upstream.
array_index_nospec() is proposed as a generic mechanism to mitigate
against Spectre-variant-1 attacks, i.e. an attack that bypasses boundary
checks via speculative execution. The array_index_nospec()
implementation is expected to be safe for current generation CPUs across
multiple architectures (ARM, x86).
Based on an original implementation by Linus Torvalds, tweaked to remove
speculative flows by Alexei Starovoitov, and tweaked again by Linus to
introduce an x86 assembly implementation for the mask generation.
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
Co-developed-by: Alexei Starovoitov <ast@kernel.org>
Suggested-by: Cyril Novikov <redacted>
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: linux-arch@vger.kernel.org
Cc: kernel-hardening@lists.openwall.com
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <redacted>
Cc: Russell King <linux@armlinux.org.uk>
Cc: gregkh@linuxfoundation.org
Cc: torvalds@linux-foundation.org
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727414229.33451.18411580953862676575.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/nospec.h | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 72 insertions(+)
create mode 100644 include/linux/nospec.h
--- /dev/null+++ b/include/linux/nospec.h
@@ -0,0 +1,72 @@+// SPDX-License-Identifier: GPL-2.0+// Copyright(c) 2018 Linus Torvalds. All rights reserved.+// Copyright(c) 2018 Alexei Starovoitov. All rights reserved.+// Copyright(c) 2018 Intel Corporation. All rights reserved.++#ifndef _LINUX_NOSPEC_H+#define _LINUX_NOSPEC_H++/**+*array_index_mask_nospec()-generatea~0maskwhenindex<size,0otherwise+*@index:arrayelementindex+*@size:numberofelementsinarray+*+*When@indexisoutofbounds(@index>=@size),thesignbitwillbe+*set.Extendthesignbittoallbitsandinvert,givingaresultof+*zeroforanoutofboundsindex,or~0ifwithinbounds[0,@size).+*/+#ifndef array_index_mask_nospec+staticinlineunsignedlongarray_index_mask_nospec(unsignedlongindex,+unsignedlongsize)+{+/*+*Warndevelopersaboutinappropriatearray_index_nospec()usage.+*+*EveniftheCPUspeculatespasttheWARN_ONCEbranch,the+*signbitof@indexistakenintoaccountwhengeneratingthe+*mask.+*+*Thiswarningiscompiledoutwhenthecompilercaninferthat+*@indexand@sizearelessthanLONG_MAX.+*/+if(WARN_ONCE(index>LONG_MAX||size>LONG_MAX,+"array_index_nospec() limited to range of [0, LONG_MAX]\n"))+return0;++/*+*Alwayscalculateandemitthemaskevenifthecompiler+*thinksthemaskisnotneeded.Thecompilerdoesnottake+*intoaccountthevalueof@indexunderspeculation.+*/+OPTIMIZER_HIDE_VAR(index);+return~(long)(index|(size-1UL-index))>>(BITS_PER_LONG-1);+}+#endif++/*+*array_index_nospec-sanitizeanarrayindexafteraboundscheck+*+*Foracodesequencelike:+*+*if(index<size){+*index=array_index_nospec(index,size);+*val=array[index];+*}+*+*...iftheCPUspeculatespasttheboundscheckthen+*array_index_nospec()willclamptheindexwithintherangeof[0,+*size).+*/+#define array_index_nospec(index, size) \+({\+typeof(index)_i=(index);\+typeof(size)_s=(size);\+unsignedlong_mask=array_index_mask_nospec(_i,_s);\+\+BUILD_BUG_ON(sizeof(_i)>sizeof(long));\+BUILD_BUG_ON(sizeof(_s)>sizeof(long));\+\+_i&=_mask;\+_i;\+})+#endif /* _LINUX_NOSPEC_H */
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit b3bbfb3fb5d25776b8e3f361d2eedaabb0b496cd upstream.
For __get_user() paths, do not allow the kernel to speculate on the value
of a user controlled pointer. In addition to the 'stac' instruction for
Supervisor Mode Access Protection (SMAP), a barrier_nospec() causes the
access_ok() result to resolve in the pipeline before the CPU might take any
speculative action on the pointer value. Given the cost of 'stac' the
speculation barrier is placed after 'stac' to hopefully overlap the cost of
disabling SMAP with the cost of flushing the instruction pipeline.
Since __get_user is a major kernel interface that deals with user
controlled pointers, the __uaccess_begin_nospec() mechanism will prevent
speculative execution past an access_ok() permission check. While
speculative execution past access_ok() is not enough to lead to a kernel
memory leak, it is a necessary precondition.
To be clear, __uaccess_begin_nospec() is addressing a class of potential
problems near __get_user() usages.
Note, that while the barrier_nospec() in __uaccess_begin_nospec() is used
to protect __get_user(), pointer masking similar to array_index_nospec()
will be used for get_user() since it incorporates a bounds check near the
usage.
uaccess_try_nospec provides the same mechanism for get_user_try.
No functional changes.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Suggested-by: Andi Kleen <redacted>
Suggested-by: Ingo Molnar <mingo@redhat.com>
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: linux-arch@vger.kernel.org
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Kees Cook <redacted>
Cc: kernel-hardening@lists.openwall.com
Cc: gregkh@linuxfoundation.org
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727415922.33451.5796614273104346583.stgit@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2:
- There's no SMAP support, so only add uaccess_try_nospec()
- Use current_thread_info() and save the previous error state, matching
uaccess_try()]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <redacted>
commit 3f7d875566d8e79c5e0b2c9a413e91b2c29e0854 upstream.
The generated assembler for the C fill RSB inline asm operations has
several issues:
- The C code sets up the loop register, which is then immediately
overwritten in __FILL_RETURN_BUFFER with the same value again.
- The C code also passes in the iteration count in another register, which
is not used at all.
Remove these two unnecessary operations. Just rely on the single constant
passed to the macro for the iterations.
Signed-off-by: Andi Kleen <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: David Woodhouse <redacted>
Cc: dave.hansen@intel.com
Cc: gregkh@linuxfoundation.org
Cc: torvalds@linux-foundation.org
Cc: arjan@linux.intel.com
Link: https://lkml.kernel.org/r/20180117225328.15414-1-andi@firstfloor.org
[bwh: Backported to 3.2: adjust contex]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/nospec-branch.h | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <longman@redhat.com>
commit 1df37383a8aeabb9b418698f0bcdffea01f4b1b2 upstream.
It doesn't make sense to have an indirect call thunk with esp/rsp as
retpoline code won't work correctly with the stack pointer register.
Removing it will help compiler writers to catch error in case such
a thunk call is emitted incorrectly.
Fixes: 76b043848fd2 ("x86/retpoline: Add initial retpoline support")
Suggested-by: Jeff Law <redacted>
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: David Woodhouse <redacted>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Kees Cook <redacted>
Cc: Andi Kleen <redacted>
Cc: Tim Chen <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Josh Poimboeuf <redacted>
Cc: Arjan van de Ven <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/1516658974-27852-1-git-send-email-longman@redhat.com
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/lib/retpoline-export.c | 1 -
arch/x86/lib/retpoline.S | 1 -
2 files changed, 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <redacted>
commit 61dc0f555b5c761cdafb0ba5bd41ecf22d68a4c4 upstream.
Implement the CPU vulnerabilty show functions for meltdown, spectre_v1 and
spectre_v2.
Signed-off-by: Thomas Gleixner <redacted>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Konrad Rzeszutek Wilk <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <redacted>
Cc: Dave Hansen <redacted>
Cc: Linus Torvalds <torvalds@linuxfoundation.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: David Woodhouse <redacted>
Link: https://lkml.kernel.org/r/20180107214913.177414879@linutronix.de
[bwh: Backported to 3.2:
- Meltdown mitigation feature flag is KAISER
- Adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/Kconfig | 1 +
arch/x86/kernel/cpu/bugs.c | 29 +++++++++++++++++++++++++++++
2 files changed, 30 insertions(+)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit 117cc7a908c83697b0b737d15ae1eb5943afe35b upstream.
In accordance with the Intel and AMD documentation, we need to overwrite
all entries in the RSB on exiting a guest, to prevent malicious branch
target predictions from affecting the host kernel. This is needed both
for retpoline and for IBRS.
[ak: numbers again for the RSB stuffing labels]
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Josh Poimboeuf <redacted>
Cc: thomas.lendacky@amd.com
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Tim Chen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/1515755487-8524-1-git-send-email-dwmw@amazon.co.uk
[bwh: Backported to 3.2:
- Drop the ANNOTATE_NOSPEC_ALTERNATIVEs
- Adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit c995efd5a740d9cbafbf58bde4973e8b50b4d761 upstream.
On context switch from a shallow call stack to a deeper one, as the CPU
does 'ret' up the deeper side it may encounter RSB entries (predictions for
where the 'ret' goes to) which were populated in userspace.
This is problematic if neither SMEP nor KPTI (the latter of which marks
userspace pages as NX for the kernel) are active, as malicious code in
userspace may then be executed speculatively.
Overwrite the CPU's return prediction stack with calls which are predicted
to return to an infinite loop, to "capture" speculation if this
happens. This is required both for retpoline, and also in conjunction with
IBRS for !SMEP && !KPTI.
On Skylake+ the problem is slightly different, and an *underflow* of the
RSB may cause errant branch predictions to occur. So there it's not so much
overwrite, as *filling* the RSB to attempt to prevent it getting
empty. This is only a partial solution for Skylake+ since there are many
other conditions which may result in the RSB becoming empty. The full
solution on Skylake+ is to use IBRS, which will prevent the problem even
when the RSB becomes empty. With IBRS, the RSB-stuffing will not be
required on context switch.
[ tglx: Added missing vendor check and slighty massaged comments and
changelog ]
[js] backport to 4.4 -- __switch_to_asm does not exist there, we
have to patch the switch_to macros for both x86_32 and x86_64.
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: Arjan van de Ven <redacted>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Josh Poimboeuf <redacted>
Cc: thomas.lendacky@amd.com
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Tim Chen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/1515779365-9032-1-git-send-email-dwmw@amazon.co.uk
Signed-off-by: Jiri Slaby <redacted>
[bwh: Backported to 3.2:
- Use the first available feature number
- Adjust filename]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/cpufeature.h | 1 +
arch/x86/include/asm/system.h | 38 ++++++++++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/bugs.c | 36 ++++++++++++++++++++++++++++++++++++
3 files changed, 75 insertions(+)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <thomas.lendacky@amd.com>
commit 9c6a73c75864ad9fa49e5fa6513e4c4071c0e29f upstream.
With LFENCE now a serializing instruction, use LFENCE_RDTSC in preference
to MFENCE_RDTSC. However, since the kernel could be running under a
hypervisor that does not support writing that MSR, read the MSR back and
verify that the bit has been set successfully. If the MSR can be read
and the bit is set, then set the LFENCE_RDTSC feature, otherwise set the
MFENCE_RDTSC feature.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Thomas Gleixner <redacted>
Reviewed-by: Reviewed-by: Borislav Petkov <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tim Chen <redacted>
Cc: Dave Hansen <redacted>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <redacted>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: David Woodhouse <redacted>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/20180108220932.12580.52458.stgit@tlendack-t1.amdoffice.net
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/msr-index.h | 1 +
arch/x86/kernel/cpu/amd.c | 18 ++++++++++++++++--
2 files changed, 17 insertions(+), 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit 9351803bd803cdbeb9b5a7850b7b6f464806e3db upstream.
Convert all indirect jumps in ftrace assembler code to use non-speculative
sequences when CONFIG_RETPOLINE is enabled.
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: Arjan van de Ven <redacted>
Acked-by: Ingo Molnar <mingo@kernel.org>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Josh Poimboeuf <redacted>
Cc: thomas.lendacky@amd.com
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Tim Chen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/1515707194-20531-8-git-send-email-dwmw@amazon.co.uk
[bwh: Backported to 3.2: adjust filenames, context]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <thomas.lendacky@amd.com>
commit 28d437d550e1e39f805d99f9f8ac399c778827b7 upstream.
The PAUSE instruction is currently used in the retpoline and RSB filling
macros as a speculation trap. The use of PAUSE was originally suggested
because it showed a very, very small difference in the amount of
cycles/time used to execute the retpoline as compared to LFENCE. On AMD,
the PAUSE instruction is not a serializing instruction, so the pause/jmp
loop will use excess power as it is speculated over waiting for return
to mispredict to the correct target.
The RSB filling macro is applicable to AMD, and, if software is unable to
verify that LFENCE is serializing on AMD (possible when running under a
hypervisor), the generic retpoline support will be used and, so, is also
applicable to AMD. Keep the current usage of PAUSE for Intel, but add an
LFENCE instruction to the speculation trap for AMD.
The same sequence has been adopted by GCC for the GCC generated retpolines.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Thomas Gleixner <redacted>
Reviewed-by: Borislav Petkov <bp@alien8.de>
Acked-by: David Woodhouse <redacted>
Acked-by: Arjan van de Ven <redacted>
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Paul Turner <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tim Chen <redacted>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Dave Hansen <redacted>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Josh Poimboeuf <redacted>
Cc: Dan Williams <redacted>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Kees Cook <redacted>
Link: https://lkml.kernel.org/r/20180113232730.31060.36287.stgit@tlendack-t1.amdoffice.net
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/nospec-branch.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <mhiramat@kernel.org>
commit c86a32c09f8ced67971a2310e3b0dda4d1749007 upstream.
Since indirect jump instructions will be replaced by jump
to __x86_indirect_thunk_*, those jmp instruction must be
treated as an indirect jump. Since optprobe prohibits to
optimize probes in the function which uses an indirect jump,
it also needs to find out the function which jump to
__x86_indirect_thunk_* and disable optimization.
Add a check that the jump target address is between the
__indirect_thunk_start/end when optimizing kprobe.
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: David Woodhouse <redacted>
Cc: Andi Kleen <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ananth N Mavinakayanahalli <redacted>
Cc: Arjan van de Ven <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Link: https://lkml.kernel.org/r/151629212062.10241.6991266100233002273.stgit@devbox
[bwh: Backported to 3.2:
- Include __kprobes in both function declarations
- Adjust filename, context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/kernel/kprobes.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
@@ -1256,7 +1257,7 @@ static int __kprobes copy_optimized_inst}/* Check whether insn is indirect jump */-staticint__kprobesinsn_is_indirect_jump(structinsn*insn)+staticint__kprobes__insn_is_indirect_jump(structinsn*insn){return((insn->opcode.bytes[0]==0xff&&(X86_MODRM_REG(insn->modrm.value)&6)==4)||/* Jump */
@@ -1290,6 +1291,26 @@ static int insn_jump_into_range(struct ireturn(start<=target&&target<=start+len);}+staticint__kprobesinsn_is_indirect_jump(structinsn*insn)+{+intret=__insn_is_indirect_jump(insn);++#ifdef CONFIG_RETPOLINE+/*+*Jumptox86_indirect_thunk_*istreatedasanindirectjump.+*NotethatevenwithCONFIG_RETPOLINE=y,thekernelcompiledwith+*oldergccmayuseindirectjump.Soweaddthischeckinsteadof+*replaceindirect-jumpcheck.+*/+if(!ret)+ret=insn_jump_into_range(insn,+(unsignedlong)__indirect_thunk_start,+(unsignedlong)__indirect_thunk_end-+(unsignedlong)__indirect_thunk_start);+#endif+returnret;+}+/* Decode whole function to ensure any instructions don't jump into target */staticint__kprobescan_optimize(unsignedlongpaddr){
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit e70e5892b28c18f517f29ab6e83bd57705104b31 upstream.
Convert all indirect jumps in hyperv inline asm code to use non-speculative
sequences when CONFIG_RETPOLINE is enabled.
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: Arjan van de Ven <redacted>
Acked-by: Ingo Molnar <mingo@kernel.org>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Josh Poimboeuf <redacted>
Cc: thomas.lendacky@amd.com
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Tim Chen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/1515707194-20531-9-git-send-email-dwmw@amazon.co.uk
[bwh: Backported to 3.2:
- Drop changes to hv_do_fast_hypercall8()
- Include earlier updates to the asm constraints
- Adjust filename, context]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/hv/hv.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
--- a/drivers/hv/hv.c+++ b/drivers/hv/hv.c
@@ -27,6 +27,7 @@#include<linux/vmalloc.h>#include<linux/hyperv.h>#include<asm/hyperv.h>+#include<asm/nospec-branch.h>#include"hyperv_vmbus.h"/* The one and only */
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <redacted>
commit a89f040fa34ec9cd682aed98b8f04e3c47d998bd upstream.
Many x86 CPUs leak information to user space due to missing isolation of
user space and kernel space page tables. There are many well documented
ways to exploit that.
The upcoming software migitation of isolating the user and kernel space
page tables needs a misfeature flag so code can be made runtime
conditional.
Add the BUG bits which indicates that the CPU is affected and add a feature
bit which indicates that the software migitation is enabled.
Assume for now that _ALL_ x86 CPUs are affected by this. Exceptions can be
made later.
Signed-off-by: Thomas Gleixner <redacted>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <redacted>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Laight <redacted>
Cc: Denys Vlasenko <redacted>
Cc: Eduardo Valentin <redacted>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <redacted>
Cc: Juergen Gross <jgross@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <redacted>
Cc: aliguori@amazon.com
Cc: daniel.gruss@iaik.tugraz.at
Cc: hughd@google.com
Cc: keescook@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.2:
- Assign the first available bug number
- Adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -214,6 +214,8 @@*/#define X86_BUG(x) (NCAPINTS*32 + (x))+#define X86_BUG_CPU_INSECURE X86_BUG(0) /* CPU is insecure and needs kernel page table isolation */+#if defined(__KERNEL__) && !defined(__ASSEMBLY__)#include<asm/asm.h>---a/arch/x86/kernel/cpu/common.c+++b/arch/x86/kernel/cpu/common.c
@@ -767,6 +767,9 @@ static void __init early_identify_cpu(stif(this_cpu->c_bsp_init)this_cpu->c_bsp_init(c);++/* Assume for now that ALL x86 CPUs are insecure */+setup_force_cpu_bug(X86_BUG_CPU_INSECURE);}void__initearly_cpu_init(void)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <redacted>
commit 76b043848fd22dbf7f8bf3a1452f8c70d557b860 upstream.
Enable the use of -mindirect-branch=thunk-extern in newer GCC, and provide
the corresponding thunks. Provide assembler macros for invoking the thunks
in the same way that GCC does, from native and inline assembler.
This adds X86_FEATURE_RETPOLINE and sets it by default on all CPUs. In
some circumstances, IBRS microcode features may be used instead, and the
retpoline can be disabled.
On AMD CPUs if lfence is serialising, the retpoline can be dramatically
simplified to a simple "lfence; jmp *\reg". A future patch, after it has
been verified that lfence really is serialising in all circumstances, can
enable this by setting the X86_FEATURE_RETPOLINE_AMD feature bit in addition
to X86_FEATURE_RETPOLINE.
Do not align the retpoline in the altinstr section, because there is no
guarantee that it stays aligned when it's copied over the oldinstr during
alternative patching.
[ Andi Kleen: Rename the macros, add CONFIG_RETPOLINE option, export thunks]
[ tglx: Put actual function CALL/JMP in front of the macros, convert to
symbolic labels ]
[ dwmw2: Convert back to numeric labels, merge objtool fixes ]
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: Arjan van de Ven <redacted>
Acked-by: Ingo Molnar <mingo@kernel.org>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Josh Poimboeuf <redacted>
Cc: thomas.lendacky@amd.com
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Tim Chen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <redacted>
Link: https://lkml.kernel.org/r/1515707194-20531-4-git-send-email-dwmw@amazon.co.uk
[bwh: Backported to 3.2:
- Add C source to export the thunk symbols
- Drop ANNOTATE_NOSPEC_ALTERNATIVE since we don't have objtool
- Use the first available feaure numbers
- Adjust filename, context]
Signed-off-by: Ben Hutchings <redacted>
---
--- a/arch/x86/Kconfig+++ b/arch/x86/Kconfig
@@ -312,6 +312,19 @@ config X86_BIGSMP---help---Thisoptionisneededforthesystemsthathavemorethan8CPUs+configRETPOLINE+bool"Avoid speculative indirect branches in kernel"+defaulty+help+Compilekernelwiththeretpolinecompileroptionstoguardagainst+kernel-to-userdataleaksbyavoidingspeculativeindirect+branches.Requiresacompilerwith-mindirect-branch=thunk-extern+supportforfullprotection.Thekernelmayrunslower.++Withoutcompilersupport,atleastindirectbranchesinassembler+codeareeliminated.Sincethisincludesthesyscallentrypath,+itisnotentirelypointless.+ifX86_32configX86_EXTENDED_PLATFORMbool"Support for extended (non-PC) x86 platforms"---a/arch/x86/Makefile+++b/arch/x86/Makefile
@@ -117,6 +117,16 @@ KBUILD_CFLAGS += $(call cc-option,-mno-s KBUILD_CFLAGS+=$(mflags-y) KBUILD_AFLAGS+=$(mflags-y)+# Avoid indirect branches in kernel to deal with Spectre+ifdefCONFIG_RETPOLINE+RETPOLINE_CFLAGS+=$(callcc-option,-mindirect-branch=thunk-extern-mindirect-branch-register)+ifneq($(RETPOLINE_CFLAGS),)+KBUILD_CFLAGS+=$(RETPOLINE_CFLAGS)-DRETPOLINE+else+$(warningCONFIG_RETPOLINE=y,butnotsupportedbythecompiler.Toolchainupdaterecommended.)+endif+endif+ archscripts:$(Q)$(MAKE)$(build)=arch/x86/toolsrelocs---a/arch/x86/include/asm/cpufeature.h+++b/arch/x86/include/asm/cpufeature.h
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <redacted>
commit b8b9ce4b5aec8de9e23cabb0a26b78641f9ab1d6 upstream.
Remove the compile time warning when CONFIG_RETPOLINE=y and the compiler
does not have retpoline support. Linus rationale for this is:
It's wrong because it will just make people turn off RETPOLINE, and the
asm updates - and return stack clearing - that are independent of the
compiler are likely the most important parts because they are likely the
ones easiest to target.
And it's annoying because most people won't be able to do anything about
it. The number of people building their own compiler? Very small. So if
their distro hasn't got a compiler yet (and pretty much nobody does), the
warning is just annoying crap.
It is already properly reported as part of the sysfs interface. The
compile-time warning only encourages bad things.
Fixes: 76b043848fd2 ("x86/retpoline: Add initial retpoline support")
Requested-by: Linus Torvalds [off-list ref]
Signed-off-by: Thomas Gleixner <redacted>
Cc: David Woodhouse <redacted>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <redacted>
Cc: Andi Kleen <redacted>
Cc: Josh Poimboeuf <redacted>
Cc: thomas.lendacky@amd.com
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <redacted>
Cc: Kees Cook <redacted>
Cc: Tim Chen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Link: https://lkml.kernel.org/r/CA+55aFzWgquv4i6Mab6bASqYXg3ErV3XDFEYf=GEcCDQg5uAtw@mail.gmail.com
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/Makefile | 2 --
1 file changed, 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit 1d91c1d2c80cb70e2e553845e278b87a960c04da upstream.
There are multiple problems with the dynamic sanity checking in
array_index_nospec_mask_check():
* It causes unnecessary overhead in the 32-bit case since integer sized
@index values will no longer cause the check to be compiled away like
in the 64-bit case.
* In the 32-bit case it may trigger with user controllable input when
the expectation is that should only trigger during development of new
kernel enabling.
* The macro reuses the input parameter in multiple locations which is
broken if someone passes an expression like 'index++' to
array_index_nospec().
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Dan Williams <redacted>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <redacted>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Josh Poimboeuf <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <redacted>
Cc: Will Deacon <redacted>
Cc: linux-arch@vger.kernel.org
Link: http://lkml.kernel.org/r/151881604278.17395.6605847763178076520.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/nospec.h | 22 +---------------------
1 file changed, 1 insertion(+), 21 deletions(-)
@@ -30,26 +30,6 @@ static inline unsigned long array_index_#endif/*-*Warndevelopersaboutinappropriatearray_index_nospec()usage.-*-*EveniftheCPUspeculatespasttheWARN_ONCEbranch,the-*signbitof@indexistakenintoaccountwhengeneratingthe-*mask.-*-*Thiswarningiscompiledoutwhenthecompilercaninferthat-*@indexand@sizearelessthanLONG_MAX.-*/-#define array_index_mask_nospec_check(index, size) \-({\-if(WARN_ONCE(index>LONG_MAX||size>LONG_MAX,\-"array_index_nospec() limited to range of [0, LONG_MAX]\n"))\-_mask=0;\-else\-_mask=array_index_mask_nospec(index,size);\-_mask;\-})--/**array_index_nospec-sanitizeanarrayindexafteraboundscheck**Foracodesequencelike:
@@ -67,7 +47,7 @@ static inline unsigned long array_index_({\typeof(index)_i=(index);\typeof(size)_s=(size);\-unsignedlong_mask=array_index_mask_nospec_check(_i,_s);\+unsignedlong_mask=array_index_mask_nospec(_i,_s);\\BUILD_BUG_ON(sizeof(_i)>sizeof(long));\BUILD_BUG_ON(sizeof(_s)>sizeof(long));\
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit 56c30ba7b348b90484969054d561f711ba196507 upstream.
'fd' is a user controlled value that is used as a data dependency to
read from the 'fdt->fd' array. In order to avoid potential leaks of
kernel memory values, block speculative execution of the instruction
stream that could issue reads based on an invalid 'file *' returned from
__fcheck_files.
Co-developed-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: linux-arch@vger.kernel.org
Cc: kernel-hardening@lists.openwall.com
Cc: gregkh@linuxfoundation.org
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: torvalds@linux-foundation.org
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727418500.33451.17392199002892248656.stgit@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/fdtable.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <mhiramat@kernel.org>
commit c1804a236894ecc942da7dc6c5abe209e56cba93 upstream.
Mark __x86_indirect_thunk_* functions as blacklist for kprobes
because those functions can be called from anywhere in the kernel
including blacklist functions of kprobes.
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: David Woodhouse <redacted>
Cc: Andi Kleen <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ananth N Mavinakayanahalli <redacted>
Cc: Arjan van de Ven <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Link: https://lkml.kernel.org/r/151629209111.10241.5444852823378068683.stgit@devbox
[bwh: Backported to 3.2: We don't have _ASM_NOKPROBE etc., so add indirect
thunks to the built-in blacklist]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -99,6 +102,11 @@ static struct kprobe_blackpoint kprobe_b{"irq_entries_start",},{"common_interrupt",},{"mcount",},/* mcount can be called from everywhere */+#ifdef CONFIG_RETPOLINE+{"__indirect_thunk_start",+/* Linker scripts can't set symbol sizes */+.range=(size_t)__indirect_thunk_size},+#endif{NULL}/* Terminator */};
@@ -1986,7 +1994,7 @@ static int __init init_kprobes(void)&size,&offset,&modname,namebuf);if(!symbol_name)kb->range=0;-else+elseif(size)kb->range=size;}---a/arch/x86/include/asm/nospec-branch.h+++b/arch/x86/include/asm/nospec-branch.h
@@ -112,6 +112,7 @@ SECTIONS__indirect_thunk_start=.;*(.text.__x86.indirect_thunk)__indirect_thunk_end=.;+__indirect_thunk_size=__indirect_thunk_end-__indirect_thunk_start;#endif/* End of text section */
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <redacted>
commit 12c69f1e94c89d40696e83804dd2f0965b5250cd upstream.
The 'noreplace-paravirt' option disables paravirt patching, leaving the
original pv indirect calls in place.
That's highly incompatible with retpolines, unless we want to uglify
paravirt even further and convert the paravirt calls to retpolines.
As far as I can tell, the option doesn't seem to be useful for much
other than introducing surprising corner cases and making the kernel
vulnerable to Spectre v2. It was probably a debug option from the early
paravirt days. So just remove it.
Signed-off-by: Josh Poimboeuf <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: Andrea Arcangeli <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andi Kleen <redacted>
Cc: Ashok Raj <redacted>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: Jun Nakajima <redacted>
Cc: Tim Chen <redacted>
Cc: Rusty Russell <redacted>
Cc: Dave Hansen <redacted>
Cc: Asit Mallick <redacted>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jason Baron <jbaron@akamai.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Alok Kataria <redacted>
Cc: Arjan Van De Ven <redacted>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Dan Williams <redacted>
Link: https://lkml.kernel.org/r/20180131041333.2x6blhxirc2kclrq@treble
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <redacted>
---
Documentation/kernel-parameters.txt | 2 --
arch/x86/kernel/alternative.c | 14 --------------
2 files changed, 16 deletions(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <mhiramat@kernel.org>
commit 736e80a4213e9bbce40a7c050337047128b472ac upstream.
Introduce start/end markers of __x86_indirect_thunk_* functions.
To make it easy, consolidate .text.__x86.indirect_thunk.* sections
to one .text.__x86.indirect_thunk section and put it in the
end of kernel text section and adds __indirect_thunk_start/end
so that other subsystem (e.g. kprobes) can identify it.
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: David Woodhouse <redacted>
Cc: Andi Kleen <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ananth N Mavinakayanahalli <redacted>
Cc: Arjan van de Ven <redacted>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Link: https://lkml.kernel.org/r/151629206178.10241.6828804696410044771.stgit@devbox
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/nospec-branch.h | 3 +++
arch/x86/kernel/vmlinux.lds.S | 6 ++++++
arch/x86/lib/retpoline.S | 2 +-
3 files changed, 10 insertions(+), 1 deletion(-)
@@ -108,6 +108,12 @@ SECTIONSIRQENTRY_TEXT*(.fixup)*(.gnu.warning)+#ifdef CONFIG_RETPOLINE+__indirect_thunk_start=.;+*(.text.__x86.indirect_thunk)+__indirect_thunk_end=.;+#endif+/* End of text section */_etext=.;}:text=0x9090---a/arch/x86/lib/retpoline.S+++b/arch/x86/lib/retpoline.S
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit edfbae53dab8348fca778531be9f4855d2ca0360 upstream.
Reflect the presence of get_user(), __get_user(), and 'syscall' protections
in sysfs. The expectation is that new and better tooling will allow the
kernel to grow more usages of array_index_nospec(), for now, only claim
mitigation for __user pointer de-references.
Reported-by: Jiri Slaby <redacted>
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: linux-arch@vger.kernel.org
Cc: kernel-hardening@lists.openwall.com
Cc: gregkh@linuxfoundation.org
Cc: torvalds@linux-foundation.org
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727420158.33451.11658324346540434635.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/kernel/cpu/bugs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
commit 2fbd7af5af8665d18bcefae3e9700be07e22b681 upstream.
The upstream version of this, touching C code, was written by Dan Williams,
with the following description:
The syscall table base is a user controlled function pointer in kernel
space. Use array_index_nospec() to prevent any out of bounds speculation.
While retpoline prevents speculating into a userspace directed target it
does not stop the pointer de-reference, the concern is leaking memory
relative to the syscall table base, by observing instruction cache
behavior.
The x86_64 assembly version for 4.4 was written by Jiri Slaby, with
the following description:
In 4.4.118, we have commit c8961332d6da (x86/syscall: Sanitize syscall
table de-references under speculation), which is a backport of upstream
commit 2fbd7af5af86. But it fixed only the C part of the upstream patch
-- the IA32 sysentry. So it ommitted completely the assembly part -- the
64bit sysentry.
Fix that in this patch by explicit array_index_mask_nospec written in
assembly. The same was used in lib/getuser.S.
However, to have "sbb" working properly, we have to switch from "cmp"
against (NR_syscalls-1) to (NR_syscalls), otherwise the last syscall
number would be "and"ed by 0. It is because the original "ja" relies on
"CF" or "ZF", but we rely only on "CF" in "sbb". That means: switch to
"jae" conditional jump too.
Final note: use rcx for mask as this is exactly what is overwritten by
the 4th syscall argument (r10) right after.
In 3.2 the x86_32 syscall table lookup is also written in assembly.
So I've taken Jiri's version and added similar masking in entry_32.S,
using edx as the temporary. edx is clobbered by SAVE_REGS and seems
to be free at this point.
In 3.2 the x86_64 entry code also lacks syscall masking for x32.
Cc: Dan Williams <redacted>
Cc: Jiri Slaby <redacted>
Cc: Jan Beulich <redacted>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Thomas Gleixner <redacted>
Cc: linux-arch@vger.kernel.org
Cc: kernel-hardening@lists.openwall.com
Cc: gregkh@linuxfoundation.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: alan@linux.intel.com
Cc: Jinpu Wang <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <redacted>
commit caf7501a1b4ec964190f31f9c3f163de252273b8 upstream.
There's a risk that a kernel which has full retpoline mitigations becomes
vulnerable when a module gets loaded that hasn't been compiled with the
right compiler or the right option.
To enable detection of that mismatch at module load time, add a module info
string "retpoline" at build time when the module was compiled with
retpoline support. This only covers compiled C source, but assembler source
or prebuilt object files are not checked.
If a retpoline enabled kernel detects a non retpoline protected module at
load time, print a warning and report it in the sysfs vulnerability file.
[ tglx: Massaged changelog ]
Signed-off-by: Andi Kleen <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: gregkh@linuxfoundation.org
Cc: torvalds@linux-foundation.org
Cc: jeyu@kernel.org
Cc: arjan@linux.intel.com
Link: https://lkml.kernel.org/r/20180125235028.31211-1-andi@firstfloor.org
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/kernel/cpu/bugs.c | 17 ++++++++++++++++-
include/linux/module.h | 9 +++++++++
kernel/module.c | 11 +++++++++++
scripts/mod/modpost.c | 9 +++++++++
4 files changed, 45 insertions(+), 1 deletion(-)
@@ -2335,6 +2335,15 @@ static inline void kmemleak_load_module(}#endif+staticvoidcheck_modinfo_retpoline(structmodule*mod,structload_info*info)+{+if(retpoline_module_ok(get_modinfo(info,"retpoline")))+return;++pr_warn("%s: loading module not compiled with retpoline compiler.\n",+mod->name);+}+/* Sets info->hdr and info->len. */staticintcopy_and_check(structload_info*info,constvoid__user*umod,unsignedlonglen,
@@ -2495,6 +2504,8 @@ static int check_modinfo(struct module *if(!get_modinfo(info,"intree"))add_taint_module(mod,TAINT_OOT_MODULE);+check_modinfo_retpoline(mod,info);+if(get_modinfo(info,"staging")){add_taint_module(mod,TAINT_CRAP);printk(KERN_WARNING"%s: module is from the staging directory,"---a/scripts/mod/modpost.c+++b/scripts/mod/modpost.c
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <redacted>
commit 196bd485ee4f03ce4c690bfcf38138abfcd0a4bc upstream.
Currently we use current_stack_pointer() function to get the value
of the stack pointer register. Since commit:
f5caf621ee35 ("x86/asm: Fix inline asm call constraints for Clang")
... we have a stack register variable declared. It can be used instead of
current_stack_pointer() function which allows to optimize away some
excessive "mov %rsp, %<dst>" instructions:
-mov %rsp,%rdx
-sub %rdx,%rax
-cmp $0x3fff,%rax
-ja ffffffff810722fd <ist_begin_non_atomic+0x2d>
+sub %rsp,%rax
+cmp $0x3fff,%rax
+ja ffffffff810722fa <ist_begin_non_atomic+0x2a>
Remove current_stack_pointer(), rename __asm_call_sp to current_stack_pointer
and use it instead of the removed function.
Signed-off-by: Andrey Ryabinin <redacted>
Reviewed-by: Josh Poimboeuf <redacted>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <redacted>
Link: http://lkml.kernel.org/r/20170929141537.29167-1-aryabinin@virtuozzo.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[dwmw2: We want ASM_CALL_CONSTRAINT for retpoline]
Signed-off-by: David Woodhouse <redacted>
Signed-off-by: Razvan Ghitulete <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: current_stack_pointer was never changed to a function,
but was only defined for x86_32]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -181,9 +181,6 @@ struct thread_info {#ifndef __ASSEMBLY__-/* how to get the current stack pointer from C */-registerunsignedlongcurrent_stack_pointerasm("esp")__used;-/* how to get the thread information struct from C */staticinlinestructthread_info*current_thread_info(void){
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit f84a56f73dddaeac1dba8045b007f742f61cd2da upstream.
Document the rationale and usage of the new array_index_nospec() helper.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <redacted>
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Reviewed-by: Kees Cook <redacted>
Cc: linux-arch@vger.kernel.org
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: gregkh@linuxfoundation.org
Cc: kernel-hardening@lists.openwall.com
Cc: torvalds@linux-foundation.org
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727413645.33451.15878817161436755393.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ben Hutchings <redacted>
---
Documentation/speculation.txt | 90 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 90 insertions(+)
create mode 100644 Documentation/speculation.txt
--- /dev/null+++ b/Documentation/speculation.txt
@@ -0,0 +1,90 @@+This document explains potential effects of speculation, and how undesirable+effects can be mitigated portably using common APIs.++===========+Speculation+===========++To improve performance and minimize average latencies, many contemporary CPUs+employ speculative execution techniques such as branch prediction, performing+work which may be discarded at a later stage.++Typically speculative execution cannot be observed from architectural state,+such as the contents of registers. However, in some cases it is possible to+observe its impact on microarchitectural state, such as the presence or+absence of data in caches. Such state may form side-channels which can be+observed to extract secret information.++For example, in the presence of branch prediction, it is possible for bounds+checks to be ignored by code which is speculatively executed. Consider the+following code:++ int load_array(int *array, unsigned int index)+ {+ if (index >= MAX_ARRAY_ELEMS)+ return 0;+ else+ return array[index];+ }++Which, on arm64, may be compiled to an assembly sequence such as:++ CMP <index>, #MAX_ARRAY_ELEMS+ B.LT less+ MOV <returnval>, #0+ RET+ less:+ LDR <returnval>, [<array>, <index>]+ RET++It is possible that a CPU mis-predicts the conditional branch, and+speculatively loads array[index], even if index >= MAX_ARRAY_ELEMS. This+value will subsequently be discarded, but the speculated load may affect+microarchitectural state which can be subsequently measured.++More complex sequences involving multiple dependent memory accesses may+result in sensitive information being leaked. Consider the following+code, building on the prior example:++ int load_dependent_arrays(int *arr1, int *arr2, int index)+ {+ int val1, val2,++ val1 = load_array(arr1, index);+ val2 = load_array(arr2, val1);++ return val2;+ }++Under speculation, the first call to load_array() may return the value+of an out-of-bounds address, while the second call will influence+microarchitectural state dependent on this value. This may provide an+arbitrary read primitive.++====================================+Mitigating speculation side-channels+====================================++The kernel provides a generic API to ensure that bounds checks are+respected even under speculation. Architectures which are affected by+speculation-based side-channels are expected to implement these+primitives.++The array_index_nospec() helper in <linux/nospec.h> can be used to+prevent information from being leaked via side-channels.++A call to array_index_nospec(index, size) returns a sanitized index+value that is bounded to [0, size) even under cpu speculation+conditions.++This can be used to protect the earlier load_array() example:++ int load_array(int *array, unsigned int index)+ {+ if (index >= MAX_ARRAY_ELEMS)+ return 0;+ else {+ index = array_index_nospec(index, MAX_ARRAY_ELEMS);+ return array[index];+ }+ }
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <peterhuewe@gmx.de>
commit fae7e4d39373305cf505d1f0871a4491897d56f9 upstream.
clang/scan-build complains that:
p80211netdev.c:451:6: warning: Branch condition evaluates to a garbage
value
if ((p80211_wep.data) && (p80211_wep.data != skb->data))
^~~~~~~~~~~~~~~~~
This can happen in p80211knetdev_hard_start_xmit if
- if (wlandev->state != WLAN_DEVICE_OPEN) evaluates to true.
the execution flow then continues at the 'failed' label where
p80211_wep.data is used without being initialized first.
-> Initialize the data field to NULL to fix this issue.
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/staging/wlan-ng/p80211netdev.c | 2 ++
1 file changed, 2 insertions(+)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jim Mattson <redacted>
commit 0cb5b30698fdc8f6b4646012e3acb4ddce430788 upstream.
Guest GPR values are live in the hardware GPRs at VM-exit. Do not
leave any guest values in hardware GPRs after the guest GPR values are
saved to the vcpu_vmx structure.
This is a partial mitigation for CVE 2017-5715 and CVE 2017-5753.
Specifically, it defeats the Project Zero PoC for CVE 2017-5715.
Suggested-by: Eric Northup <redacted>
Signed-off-by: Jim Mattson <redacted>
Reviewed-by: Eric Northup <redacted>
Reviewed-by: Benjamin Serebrin <redacted>
Reviewed-by: Andrew Honig <redacted>
[Paolo: Add AMD bits, Signed-off-by: Tom Lendacky [off-list ref]]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/kvm/svm.c | 19 +++++++++++++++++++
arch/x86/kvm/vmx.c | 14 +++++++++++++-
2 files changed, 32 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit eb6174f6d1be16b19cfa43dac296bfed003ce1a6 upstream.
The nospec.h header expects the per-architecture header file
<asm/barrier.h> to optionally define array_index_mask_nospec(). Include
that dependency to prevent inadvertent fallback to the default
array_index_mask_nospec() implementation.
The default implementation may not provide a full mitigation
on architectures that perform data value speculation.
Reported-by: Christian Borntraeger <redacted>
Signed-off-by: Dan Williams <redacted>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <redacted>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Josh Poimboeuf <redacted>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <redacted>
Cc: Will Deacon <redacted>
Cc: linux-arch@vger.kernel.org
Link: http://lkml.kernel.org/r/151881605404.17395.1341935530792574707.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.2: include <asm/system.h> instead]
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/nospec.h | 1 +
1 file changed, 1 insertion(+)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit c7f631cb07e7da06ac1d231ca178452339e32a94 upstream.
Quoting Linus:
I do think that it would be a good idea to very expressly document
the fact that it's not that the user access itself is unsafe. I do
agree that things like "get_user()" want to be protected, but not
because of any direct bugs or problems with get_user() and friends,
but simply because get_user() is an excellent source of a pointer
that is obviously controlled from a potentially attacking user
space. So it's a prime candidate for then finding _subsequent_
accesses that can then be used to perturb the cache.
Unlike the __get_user() case get_user() includes the address limit check
near the pointer de-reference. With that locality the speculation can be
mitigated with pointer narrowing rather than a barrier, i.e.
array_index_nospec(). Where the narrowing is performed by:
cmp %limit, %ptr
sbb %mask, %mask
and %mask, %ptr
With respect to speculation the value of %ptr is either less than %limit
or NULL.
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: linux-arch@vger.kernel.org
Cc: Kees Cook <redacted>
Cc: kernel-hardening@lists.openwall.com
Cc: gregkh@linuxfoundation.org
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: torvalds@linux-foundation.org
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727417469.33451.11804043010080838495.stgit@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2:
- Drop changes to 32-bit implementation of __get_user_8
- Adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/lib/getuser.S | 10 ++++++++++
1 file changed, 10 insertions(+)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <redacted>
commit 9de29eac8d2189424d81c0d840cd0469aa3d41c8 upstream.
If i == ARRAY_SIZE(mitigation_options) then we accidentally print
garbage from one space beyond the end of the mitigation_options[] array.
Signed-off-by: Dan Carpenter <redacted>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <redacted>
Cc: David Woodhouse <redacted>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: KarimAllah Ahmed <redacted>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <redacted>
Cc: kernel-janitors@vger.kernel.org
Fixes: 9005c6834c0f ("x86/spectre: Simplify spectre_v2 command line parsing")
Link: http://lkml.kernel.org/r/20180214071416.GA26677@mwanda
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -317,8 +317,7 @@ static enum spectre_v2_mitigation_cmd __}if(i>=ARRAY_SIZE(mitigation_options)){-pr_err("unknown option (%s). Switching to AUTO select\n",-mitigation_options[i].option);+pr_err("unknown option (%s). Switching to AUTO select\n",arg);returnSPECTRE_V2_CMD_AUTO;}}
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <redacted>
commit e698dcdfcda41efd0984de539767b4cddd235f1e upstream.
Trivial fix to spelling mistake in pr_err error message text.
Signed-off-by: Colin Ian King <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Cc: Andi Kleen <redacted>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: kernel-janitors@vger.kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <redacted>
Cc: David Woodhouse <redacted>
Link: https://lkml.kernel.org/r/20180130193218.9271-1-colin.king@canonical.com
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/kernel/cpu/bugs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
@@ -245,7 +245,7 @@ bool retpoline_module_ok(bool has_retpolif(spectre_v2_enabled==SPECTRE_V2_NONE||has_retpoline)returntrue;-pr_err("System may be vunerable to spectre v2\n");+pr_err("System may be vulnerable to spectre v2\n");spectre_v2_bad_module=true;returnfalse;}
From: Ben Hutchings <hidden> Date: 2018-03-12 03:03:34
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
I ran into a 4.9 build warning in randconfig testing, starting with the
KAISER patches:
arch/x86/kernel/ldt.c: In function 'alloc_ldt_struct':
arch/x86/include/asm/pgtable_types.h:208:24: error: large integer implicitly truncated to unsigned type [-Werror=overflow]
#define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
^
arch/x86/kernel/ldt.c:81:6: note: in expansion of macro '__PAGE_KERNEL'
__PAGE_KERNEL);
^~~~~~~~~~~~~
I originally ran into this last year when the patches were part of linux-next,
and tried to work around it by using the proper 'pteval_t' types consistently,
but that caused additional problems.
This takes a much simpler approach, and makes the argument type of the dummy
helper always 64-bit, which is wide enough for any page table layout and
won't hurt since this call is just an empty stub anyway.
Fixes: 8f0baadf2bea ("kaiser: merged update")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Kees Cook <redacted>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/kaiser.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:07:39
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Han Shen <shenhan@google.com>
commit 6b13eb1baa17b8746f96bd536d2897ec86e823d9 upstream.
Fix warnings about unused local typedefs (reported by gcc 4.8).
Signed-off-by: Han Shen (shenhan@google.com)
Change-Id: I4bccc234f1390daa808d2b309ed112e20c0ac096
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <redacted>
---
fs/compat_ioctl.c | 1 -
1 file changed, 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:07:40
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit e74fc973b6e531fef1fce8b101ffff05ecfb774c upstream.
gcc-4.7 and higher add a lot of false positive warnings about
potential uses of uninitialized warnings, but only when optimizing
for size (-Os). This is the default when building allyesconfig,
which turns on CONFIG_CC_OPTIMIZE_FOR_SIZE.
In order to avoid getting a lot of patches that initialize such
variables and accidentally hide real errors along the way, let's
just turn off this warning on the respective gcc versions
when building with size optimizations. The -Wmaybe-uninitialized
option was introduced in the same gcc version (4.7) that is now
causing the false positives, so there is no effect on older compilers.
A side effect is that when building with CONFIG_CC_OPTIMIZE_FOR_SIZE,
we might now see /fewer/ warnings about possibly uninitialized
warnings than with -O2, but that is still much better than seeing
warnings known to be bogus.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Ben Hutchings <redacted>
---
Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:07:41
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <redacted>
commit 8a8e31cc22739d1a5780591c008940292edcde87 upstream.
When this driver is built with "make W=1", the following warning occurs:
drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c:907:4: warning: comparison is always false due to limited range of data type [-Wtype-limits]
Signed-off-by: Larry Finger <redacted>
Signed-off-by: John W. Linville <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:07:42
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yunlian Jiang <redacted>
commit ec71997eff2231098212a99934c0fb987a9e6b04 upstream.
GCC 4.8 is spitting out uninitialized-variable warnings against
"drivers/net/wireless/rtlwifi/rtl8192de/dm.c".
drivers/net/wireless/rtlwifi/rtl8192de/dm.c:941:31:
error: 'ofdm_index_old[1]' may be used uninitialized in this
function [-Werror=maybe-uninitialized]
rtlpriv->dm.ofdm_index[i] = ofdm_index_old[i];
This patch adds initialization to the variable and properly sets its value.
Signed-off-by: Yunlian Jiang <redacted>
Acked-by: Larry Finger <redacted>
Signed-off-by: John W. Linville <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/wireless/rtlwifi/rtl8192de/dm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:16:25
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <redacted>
commit 085331dfc6bbe3501fb936e657331ca943827600 upstream.
Commit 75f139aaf896 "KVM: x86: Add memory barrier on vmcs field lookup"
added a raw 'asm("lfence");' to prevent a bounds check bypass of
'vmcs_field_to_offset_table'.
The lfence can be avoided in this path by using the array_index_nospec()
helper designed for these types of fixes.
Signed-off-by: Dan Williams <redacted>
Signed-off-by: Thomas Gleixner <redacted>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Andrew Honig <redacted>
Cc: kvm@vger.kernel.org
Cc: Jim Mattson <redacted>
Link: https://lkml.kernel.org/r/151744959670.6342.3001723920950249067.stgit@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2:
- Replace max_vmcs_field with the local size variable
- Adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:22:11
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Bolle <redacted>
commit bb263e18f481199a04f7aab9454c18cd3dbdb218 upstream.
Building atp.o triggers this GCC warning:
drivers/net/ethernet/realtek/atp.c: In function ‘set_rx_mode’:
drivers/net/ethernet/realtek/atp.c:871:26: warning: ‘mc_filter[0]’ may be used uninitialized in this function [-Wuninitialized]
GCC is correct. In promiscuous mode 'mc_filter' will be used
uninitialized in set_rx_mode_8012(), which is apparently inlined into
set_rx_mode().
But it turns out set_rx_mode_8012() will never be called, since
net_local.chip_type will always be RTL8002. So we can just remove
set_rx_mode_8012() and do some related cleanups.
Signed-off-by: Paul Bolle <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/realtek/atp.c | 58 ++------------------------------------
drivers/net/ethernet/realtek/atp.h | 2 --
2 files changed, 2 insertions(+), 58 deletions(-)
@@ -176,8 +176,7 @@ struct net_local {unsignedinttx_unit_busy:1;unsignedcharre_tx,/* Number of packet retransmissions. */addr_mode,/* Current Rx filter e.g. promiscuous, etc. */-pac_cnt_in_tx_buf,-chip_type;+pac_cnt_in_tx_buf;};/* This code, written by wwc@super.org, resets the adapter every
@@ -340,7 +339,6 @@ static int __init atp_probe1(long ioaddrwrite_reg_high(ioaddr,CMR1,CMR1h_RESET|CMR1h_MUX);lp=netdev_priv(dev);-lp->chip_type=RTL8002;lp->addr_mode=CMR2h_Normal;spin_lock_init(&lp->lock);
@@ -865,58 +863,6 @@ static void set_rx_mode_8002(struct net_write_reg_high(ioaddr,CMR2,lp->addr_mode);}-staticvoidset_rx_mode_8012(structnet_device*dev)-{-structnet_local*lp=netdev_priv(dev);-longioaddr=dev->base_addr;-unsignedcharnew_mode,mc_filter[8];/* Multicast hash filter */-inti;--if(dev->flags&IFF_PROMISC){/* Set promiscuous. */-new_mode=CMR2h_PROMISC;-}elseif((netdev_mc_count(dev)>1000)||-(dev->flags&IFF_ALLMULTI)){-/* Too many to filter perfectly -- accept all multicasts. */-memset(mc_filter,0xff,sizeof(mc_filter));-new_mode=CMR2h_Normal;-}else{-structnetdev_hw_addr*ha;--memset(mc_filter,0,sizeof(mc_filter));-netdev_for_each_mc_addr(ha,dev){-intfilterbit=ether_crc_le(ETH_ALEN,ha->addr)&0x3f;-mc_filter[filterbit>>5]|=1<<(filterbit&31);-}-new_mode=CMR2h_Normal;-}-lp->addr_mode=new_mode;-write_reg(ioaddr,CMR2,CMR2_IRQOUT|0x04);/* Switch to page 1. */-for(i=0;i<8;i++)-write_reg_byte(ioaddr,i,mc_filter[i]);-if(net_debug>2||1){-lp->addr_mode=1;-printk(KERN_DEBUG"%s: Mode %d, setting multicast filter to",-dev->name,lp->addr_mode);-for(i=0;i<8;i++)-printk(" %2.2x",mc_filter[i]);-printk(".\n");-}--write_reg_high(ioaddr,CMR2,lp->addr_mode);-write_reg(ioaddr,CMR2,CMR2_IRQOUT);/* Switch back to page 0 */-}--staticvoidset_rx_mode(structnet_device*dev)-{-structnet_local*lp=netdev_priv(dev);--if(lp->chip_type==RTL8002)-returnset_rx_mode_8002(dev);-else-returnset_rx_mode_8012(dev);-}--staticint__initatp_init_module(void){if(debug)/* Emit version even if no cards detected. */printk(KERN_INFO"%s",version);---a/drivers/net/ethernet/realtek/atp.h+++b/drivers/net/ethernet/realtek/atp.h
From: Ben Hutchings <hidden> Date: 2018-03-12 03:23:51
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Kalle Valo <redacted>
commit 31b9cc9a873dcab161999622314f98a75d838975 upstream.
Jason noticed that with Yocto GCC 4.8.1 ath6kl crashes with this iperf command:
iperf -c $TARGET_IP -i 5 -t 50 -w 1M
The crash was:
Unable to handle kernel paging request at virtual address 1a480000
pgd = 80004000
[1a480000] *pgd=00000000
Internal error: Oops: 805 [#1] SMP ARM
Modules linked in: ath6kl_sdio ath6kl_core [last unloaded: ath6kl_core]
CPU: 0 PID: 1953 Comm: kworker/u4:0 Not tainted 3.10.9-1.0.0_alpha+dbf364b #1
Workqueue: ath6kl ath6kl_sdio_write_async_work [ath6kl_sdio]
task: dcc9a680 ti: dc9ae000 task.ti: dc9ae000
PC is at v7_dma_clean_range+0x20/0x38
LR is at dma_cache_maint_page+0x50/0x54
pc : [<8001a6f8>] lr : [<800170fc>] psr: 20000093
sp : dc9afcf8 ip : 8001a748 fp : 00000004
r10: 00000000 r9 : 00000001 r8 : 00000000
r7 : 00000001 r6 : 00000000 r5 : 80cb7000 r4 : 03f9a480
r3 : 0000001f r2 : 00000020 r1 : 1a480000 r0 : 1a480000
Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 10c53c7d Table: 6cc5004a DAC: 00000015
Process kworker/u4:0 (pid: 1953, stack limit = 0xdc9ae238)
Stack: (0xdc9afcf8 to 0xdc9b0000)
fce0: 80c9b29c 00000000
fd00: 00000000 80017134 8001a748 dc302ac0 00000000 00000000 dc454a00 80c12ed8
fd20: dc115410 80017238 00000000 dc454a10 00000001 80017588 00000001 00000000
fd40: 00000000 dc302ac0 dc9afe38 dc9afe68 00000004 80c12ed8 00000000 dc454a00
fd60: 00000004 80436f88 00000000 00000000 00000600 0000ffff 0000000c 80c113c4
fd80: 80c9b29c 00000001 00000004 dc115470 60000013 dc302ac0 dc46e000 dc302800
fda0: dc9afe10 dc302b78 60000013 dc302ac0 dc46e000 00000035 dc46e5b0 80438c90
fdc0: dc9afe10 dc302800 dc302800 dc9afe68 dc9afe38 80424cb4 00000005 dc9afe10
fde0: dc9afe20 80424de8 dc9afe10 dc302800 dc46e910 80424e90 dc473c00 dc454f00
fe00: 000001b5 7f619d64 dcc7c830 00000000 00000000 dc9afe38 dc9afe68 00000000
fe20: 00000000 00000000 dc9afe28 dc9afe28 80424d80 00000000 00000035 9cac0034
fe40: 00000000 00000000 00000000 00000000 000001b5 00000000 00000000 00000000
fe60: dc9afe68 dc9afe10 3b9aca00 00000000 00000080 00000034 00000000 00000100
fe80: 00000000 00000000 dc9afe10 00000004 dc454a00 00000000 dc46e010 dc46e96c
fea0: dc46e000 dc46e964 00200200 00100100 dc46e910 7f619ec0 00000600 80c0e770
fec0: dc15a900 dcc7c838 00000000 dc46e954 8042d434 dcc44680 dc46e954 dc004400
fee0: dc454500 00000000 00000000 dc9ae038 dc004400 8003c450 dcc44680 dc004414
ff00: dc46e954 dc454500 00000001 dcc44680 dc004414 dcc44698 dc9ae000 dc9ae030
ff20: 00000001 dc9ae000 dc004400 8003d158 8003d020 00000000 00000000 80c53941
ff40: dc9aff64 dcb71ea0 00000000 dcc44680 8003d020 00000000 00000000 00000000
ff60: 00000000 80042480 00000000 00000000 000000f8 dcc44680 00000000 00000000
ff80: dc9aff80 dc9aff80 00000000 00000000 dc9aff90 dc9aff90 dc9affac dcb71ea0
ffa0: 800423cc 00000000 00000000 8000e018 00000000 00000000 00000000 00000000
ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ffe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
[<8001a6f8>] (v7_dma_clean_range+0x20/0x38) from [<800170fc>] (dma_cache_maint_page+0x50/0x54)
[<800170fc>] (dma_cache_maint_page+0x50/0x54) from [<80017134>] (__dma_page_cpu_to_dev+0x34/0x9c)
[<80017134>] (__dma_page_cpu_to_dev+0x34/0x9c) from [<80017238>] (arm_dma_map_page+0x64/0x68)
[<80017238>] (arm_dma_map_page+0x64/0x68) from [<80017588>] (arm_dma_map_sg+0x7c/0xf4)
[<80017588>] (arm_dma_map_sg+0x7c/0xf4) from [<80436f88>] (sdhci_send_command+0x894/0xe00)
[<80436f88>] (sdhci_send_command+0x894/0xe00) from [<80438c90>] (sdhci_request+0xc0/0x1ec)
[<80438c90>] (sdhci_request+0xc0/0x1ec) from [<80424cb4>] (mmc_start_request+0xb8/0xd4)
[<80424cb4>] (mmc_start_request+0xb8/0xd4) from [<80424de8>] (__mmc_start_req+0x60/0x84)
[<80424de8>] (__mmc_start_req+0x60/0x84) from [<80424e90>] (mmc_wait_for_req+0x10/0x20)
[<80424e90>] (mmc_wait_for_req+0x10/0x20) from [<7f619d64>] (ath6kl_sdio_scat_rw.isra.10+0x1dc/0x240 [ath6kl_sdio])
[<7f619d64>] (ath6kl_sdio_scat_rw.isra.10+0x1dc/0x240 [ath6kl_sdio]) from [<7f619ec0>] (ath6kl_sdio_write_async_work+0x5c/0x104 [ath6kl_sdio])
[<7f619ec0>] (ath6kl_sdio_write_async_work+0x5c/0x104 [ath6kl_sdio]) from [<8003c450>] (process_one_work+0x10c/0x370)
[<8003c450>] (process_one_work+0x10c/0x370) from [<8003d158>] (worker_thread+0x138/0x3fc)
[<8003d158>] (worker_thread+0x138/0x3fc) from [<80042480>] (kthread+0xb4/0xb8)
[<80042480>] (kthread+0xb4/0xb8) from [<8000e018>] (ret_from_fork+0x14/0x3c)
Code: e1a02312 e2423001 e1c00003 f57ff04f (ee070f3a)
---[ end trace 0c038f0b8e0b67a3 ]---
Kernel panic - not syncing: Fatal exception
Jason's analysis:
"The GCC 4.8.1 compiler will not do the for-loop till scat_entries, instead,
it only run one round loop. This may be caused by that the GCC 4.8.1 thought
that the scat_list only have one item and then no need to do full iteration,
but this is simply wrong by looking at the assebly code. This will cause the sg
buffer not get set when scat_entries > 1 and thus lead to kernel panic.
Note: This issue not observed with GCC 4.7.2, only found on the GCC 4.8.1)"
Fix this by using the normal [0] style for defining unknown number of list
entries following the struct. This also fixes corruption with scat_q_depth, which
was mistankely added to the end of struct and overwritten if there were more
than item in the scat list.
Reported-by: Jason Liu <redacted>
Tested-by: Jason Liu <redacted>
Signed-off-by: Kalle Valo <redacted>
[bwh: Backported to 3.2: There's no scat_q_depth field]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:24:14
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <redacted>
commit 7a3ee7538598e0d60e6aa87dcf34a4e8a0adebc2 upstream.
Internally used symbols of modpost don't need to be externally visible;
make them static. Also constify the string arrays so they resist in the
r/o section instead of being runtime writable.
Those changes lead to a small size reduction as can be seen below:
text data bss dec hex filename
51381 2640 12416 66437 10385 scripts/mod/modpost.old
51765 2224 12416 66405 10365 scripts/mod/modpost.new
Signed-off-by: Mathias Krause <redacted>
Signed-off-by: Rusty Russell <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
scripts/mod/modpost.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
@@ -28,9 +28,9 @@/* Are we using CONFIG_MODVERSIONS? */-intmodversions=0;+staticintmodversions=0;/* Warn about undefined symbols? (do so if we have vmlinux) */-inthave_vmlinux=0;+staticinthave_vmlinux=0;/* Is CONFIG_MODULE_SRCVERSION_ALL set? */staticintall_versions=0;/* If we are modposting external module set to 1 */
@@ -225,7 +225,7 @@ static struct symbol *find_symbol(constreturnNULL;}-staticstruct{+staticconststruct{constchar*str;enumexportexport;}export_list[]={
@@ -816,7 +816,7 @@ static int match(const char *sym, const}/* sections that we do not want to do full section mismatch check on */-staticconstchar*section_white_list[]=+staticconstchar*constsection_white_list[]={".comment*",".debug*",
@@ -888,17 +888,18 @@ static void check_section(const char *mo#define MEM_EXIT_SECTIONS ".memexit.*"/* init data sections */-staticconstchar*init_data_sections[]={ALL_INIT_DATA_SECTIONS,NULL};+staticconstchar*constinit_data_sections[]=+{ALL_INIT_DATA_SECTIONS,NULL};/* all init sections */-staticconstchar*init_sections[]={ALL_INIT_SECTIONS,NULL};+staticconstchar*constinit_sections[]={ALL_INIT_SECTIONS,NULL};/* All init and exit sections (code + data) */-staticconstchar*init_exit_sections[]=+staticconstchar*constinit_exit_sections[]={ALL_INIT_SECTIONS,ALL_EXIT_SECTIONS,NULL};/* data section */-staticconstchar*data_sections[]={DATA_SECTIONS,NULL};+staticconstchar*constdata_sections[]={DATA_SECTIONS,NULL};/* symbols in .data that may refer to init/exit sections */
From: Ben Hutchings <hidden> Date: 2018-03-12 03:24:15
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Bolle <redacted>
commit cb31c7487580a0cfc6eb253e604c1e51ac8eb3c8 upstream.
Building budget-av.o triggers this GCC warning:
In file included from drivers/media/pci/ttpci/budget-av.c:44:0:
drivers/media/dvb-frontends/tda8261_cfg.h: In function ‘tda8261_get_bandwidth’:
drivers/media/dvb-frontends/tda8261_cfg.h:68:21: warning: ‘t_state.bandwidth’ may be used uninitialized in this function [-Wuninitialized]
Move the printk() that uses t_state.bandwith to the location where it
should be initialized to fix this.
Signed-off-by: Paul Bolle <redacted>
Signed-off-by: Mauro Carvalho Chehab <redacted>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/media/dvb/frontends/tda8261_cfg.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:25:27
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tim Gardner <redacted>
commit b8850d1fa8e2f6653e57daf6d08e58c5f5eb2c85 upstream.
The gcc version 4.9.1 compiler complains Even though it isn't possible for
these variables to not get initialized before they are used.
fs/namespace.c: In function ‘SyS_mount’:
fs/namespace.c:2720:8: warning: ‘kernel_dev’ may be used uninitialized in this function [-Wmaybe-uninitialized]
ret = do_mount(kernel_dev, kernel_dir->name, kernel_type, flags,
^
fs/namespace.c:2699:8: note: ‘kernel_dev’ was declared here
char *kernel_dev;
^
fs/namespace.c:2720:8: warning: ‘kernel_type’ may be used uninitialized in this function [-Wmaybe-uninitialized]
ret = do_mount(kernel_dev, kernel_dir->name, kernel_type, flags,
^
fs/namespace.c:2697:8: note: ‘kernel_type’ was declared here
char *kernel_type;
^
Fix the warnings by simplifying copy_mount_string() as suggested by Al Viro.
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Tim Gardner <redacted>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <redacted>
---
fs/compat.c | 10 ++++++----
fs/internal.h | 2 +-
fs/namespace.c | 26 ++++++++------------------
3 files changed, 15 insertions(+), 23 deletions(-)
--- a/fs/compat.c+++ b/fs/compat.c
@@ -797,8 +797,9 @@ asmlinkage long compat_sys_mount(const cchar*dir_page;intretval;-retval=copy_mount_string(type,&kernel_type);-if(retval<0)+kernel_type=copy_mount_string(type);+retval=PTR_ERR(kernel_type);+if(IS_ERR(kernel_type))gotoout;dir_page=getname(dir_name);
@@ -806,8 +807,9 @@ asmlinkage long compat_sys_mount(const cif(IS_ERR(dir_page))gotoout1;-retval=copy_mount_string(dev_name,&kernel_dev);-if(retval<0)+kernel_dev=copy_mount_string(dev_name);+retval=PTR_ERR(kernel_dev);+if(IS_ERR(kernel_dev))gotoout2;retval=copy_mount_options(data,&data_page);---a/fs/internal.h+++b/fs/internal.h
@@ -60,7 +60,7 @@ extern int check_unsafe_exec(struct linu*namespace.c*/externintcopy_mount_options(constvoid__user*,unsignedlong*);-externintcopy_mount_string(constvoid__user*,char**);+externchar*copy_mount_string(constvoid__user*);externunsignedintmnt_get_count(structvfsmount*mnt);externstructvfsmount*__lookup_mnt(structvfsmount*,structdentry*,int);---a/fs/namespace.c+++b/fs/namespace.c
@@ -2253,21 +2253,9 @@ int copy_mount_options(const void __userreturn0;}-intcopy_mount_string(constvoid__user*data,char**where)+char*copy_mount_string(constvoid__user*data){-char*tmp;--if(!data){-*where=NULL;-return0;-}--tmp=strndup_user(data,PAGE_SIZE);-if(IS_ERR(tmp))-returnPTR_ERR(tmp);--*where=tmp;-return0;+returndata?strndup_user(data,PAGE_SIZE):NULL;}/*
@@ -168,7 +168,7 @@ int fixpt_div32(u32 dividend, u32 divisointi;if(0==divisor)-return-1;+return-EINVAL;q=dividend/divisor;remainder=dividend-q*divisor;
@@ -194,10 +194,13 @@ static int max2165_set_rf(struct max2165u8tf_ntch;u32t;u32quotient,fraction;+intret;/* Set PLL divider according to RF frequency */-fixpt_div32(freq/1000,priv->config->osc_clk*1000,-"ient,&fraction);+ret=fixpt_div32(freq/1000,priv->config->osc_clk*1000,+"ient,&fraction);+if(ret!=0)+returnret;/* 20-bit fraction */fraction>>=12;
From: Ben Hutchings <hidden> Date: 2018-03-12 03:25:29
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Avi Kivity <redacted>
commit b188c81f2e1a188ddda6a3d353e5b546c30a9b90 upstream.
Use macros for bitness-insensitive register names, instead of
rolling our own.
Signed-off-by: Avi Kivity <redacted>
Signed-off-by: Marcelo Tosatti <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/kvm/vmx.c | 69 ++++++++++++++++++++++++------------------------------
1 file changed, 30 insertions(+), 39 deletions(-)
--- a/arch/x86/kvm/vmx.c+++ b/arch/x86/kvm/vmx.c
@@ -6130,14 +6130,6 @@ static void atomic_switch_perf_msrs(strumsrs[i].host);}-#ifdef CONFIG_X86_64-#define R "r"-#define Q "q"-#else-#define R "e"-#define Q "l"-#endif-staticvoid__noclonevmx_vcpu_run(structkvm_vcpu*vcpu){structvcpu_vmx*vmx=to_vmx(vcpu);
From: Ben Hutchings <hidden> Date: 2018-03-12 03:25:29
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Gortmaker <redacted>
commit 4a3893d069b788f3570c19c12d9e986e8e15870f upstream.
Currently an allyesconfig build [gcc-4.9.1] can generate the following:
WARNING: vmlinux.o(.text.unlikely+0x3864): Section mismatch in
reference from the function cpumask_empty.constprop.3() to the
variable .init.data:nmi_ipi_mask
which comes from the cpumask_empty usage in arch/x86/kernel/nmi_selftest.c.
Normally we would not see a symbol entry for cpumask_empty since it is:
static inline bool cpumask_empty(const struct cpumask *srcp)
however in this case, the variant of the symbol gets emitted when GCC does
constant propagation optimization.
Fix things up so that any locally optimized constprop variants don't warn
when accessing variables that live in the __init sections.
Signed-off-by: Paul Gortmaker <redacted>
Signed-off-by: Rusty Russell <redacted>
[bwh: Backported to 3.2: Add definitions of {OTHER,ALL}_TEXT_SECTIONS]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2018-03-12 03:25:30
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "H. Peter Anvin" <redacted>
commit 76f30759f690db21ca567a20665ed2679ad3235b upstream.
Add header guards to protect <asm/alternative-asm.h> against multiple
inclusion.
Signed-off-by: H. Peter Anvin <redacted>
Link: http://lkml.kernel.org/r/1348256595-29119-6-git-send-email-hpa@linux.intel.com
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/alternative-asm.h | 5 +++++
1 file changed, 5 insertions(+)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:27:05
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit bfd1ff6375c82930bfb3b401eee2c96720fa8e84 upstream.
Adding BIT(x) equivalent for unsigned long long type, BIT_ULL(x). Also
added BIT_ULL_MASK and BIT_ULL_WORD.
Suggested-by: Joe Perches <joe@perches.com>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jacob Pan <redacted>
Signed-off-by: Rafael J. Wysocki <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/bitops.h | 3 +++
1 file changed, 3 insertions(+)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:28:05
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Gortmaker <redacted>
commit 69349c2dc01c489eccaa4c472542c08e370c6d7e upstream.
Using IS_ENABLED() within C (vs. within CPP #if statements) in its
current form requires us to actually define every possible bool/tristate
Kconfig option twice (__enabled_* and __enabled_*_MODULE variants).
This results in a huge autoconf.h file, on the order of 16k lines for a
x86_64 defconfig.
Fixing IS_ENABLED to be able to work on the smaller subset of just
things that we really have defined is step one to fixing this. Which
means it has to not choke when fed non-enabled options, such as:
include/linux/netdevice.h:964:1: warning: "__enabled_CONFIG_FCOE_MODULE" is not defined [-Wundef]
The original prototype of how to implement a C and preprocessor
compatible way of doing this came from the Google+ user "comex ." in
response to Linus' crowdsourcing challenge for a possible improvement on
his earlier C specific solution:
#define config_enabled(x) (__stringify(x)[0] == '1')
In this implementation, I've chosen variable names that hopefully make
how it works more understandable.
Signed-off-by: Paul Gortmaker <redacted>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/kconfig.h | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:28:06
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Avi Kivity <redacted>
commit 7454766f7bead388251aedee35a478356a7f4e72 upstream.
Use macros for bitness-insensitive register names, instead of
rolling our own.
Signed-off-by: Avi Kivity <redacted>
Signed-off-by: Marcelo Tosatti <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/kvm/svm.c | 46 ++++++++++++++++++++--------------------------
1 file changed, 20 insertions(+), 26 deletions(-)
--- a/arch/x86/kvm/svm.c+++ b/arch/x86/kvm/svm.c
@@ -3679,12 +3679,6 @@ static void svm_cancel_injection(structsvm_complete_interrupts(svm);}-#ifdef CONFIG_X86_64-#define R "r"-#else-#define R "e"-#endif-staticvoidsvm_vcpu_run(structkvm_vcpu*vcpu){structvcpu_svm*svm=to_svm(vcpu);
From: Ben Hutchings <hidden> Date: 2018-03-12 03:28:08
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan-Simon Möller <redacted>
commit 3e9b2327b59801e677a7581fe4d2541ca749dcab upstream.
The __ASM_* macros (e.g. __ASM_DX) are used to return the proper
register name (e.g. edx for 32bit / rdx for 64bit). We want to use
this also in arch/x86/include/asm/uaccess.h / get_user() . For this
to work, we need a raw form as both gcc and clang choke on the
whitespace in a register asm() statement, and the __ASM_FORM macro
surrounds the argument with blanks. A new macro, __ASM_FORM_RAW was
added and we change __ASM_REG to use the new RAW form.
Signed-off-by: Jan-Simon Möller <redacted>
Link: http://lkml.kernel.org/r/1377803585-5913-2-git-send-email-dl9pf@gmx.de
Signed-off-by: H. Peter Anvin <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/asm.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:28:25
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dave Hansen <redacted>
commit 970442c599b22ccd644ebfe94d1d303bf6f87c05 upstream.
Problem:
We have a boatload of open-coded family-6 model numbers. Half of
them have these model numbers in hex and the other half in
decimal. This makes grepping for them tons of fun, if you were
to try.
Solution:
Consolidate all the magic numbers. Put all the definitions in
one header.
The names here are closely derived from the comments describing
the models from arch/x86/events/intel/core.c. We could easily
make them shorter by doing things like s/SANDYBRIDGE/SNB/, but
they seemed fine even with the longer versions to me.
Do not take any of these names too literally, like "DESKTOP"
or "MOBILE". These are all colloquial names and not precise
descriptions of everywhere a given model will show up.
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <redacted>
Cc: Darren Hart <dvhart@infradead.org>
Cc: Dave Hansen <redacted>
Cc: Denys Vlasenko <redacted>
Cc: Doug Thompson <redacted>
Cc: Eduardo Valentin <edubezval@gmail.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jacob Pan <redacted>
Cc: Kan Liang <redacted>
Cc: Len Brown <lenb@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mauro Carvalho Chehab <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rafael J. Wysocki <redacted>
Cc: Rajneesh Bhardwaj <redacted>
Cc: Souvik Kumar Chakravarty <redacted>
Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: Stephane Eranian <redacted>
Cc: Thomas Gleixner <redacted>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Ulf Hansson <redacted>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Vishwanath Somayaji <redacted>
Cc: Zhang Rui <rui.zhang@intel.com>
Cc: jacob.jun.pan@intel.com
Cc: linux-acpi@vger.kernel.org
Cc: linux-edac@vger.kernel.org
Cc: linux-mmc@vger.kernel.org
Cc: linux-pm@vger.kernel.org
Cc: platform-driver-x86@vger.kernel.org
Link: http://lkml.kernel.org/r/20160603001927.F2A7D828@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/intel-family.h | 68 +++++++++++++++++++++++++++++++++++++
1 file changed, 68 insertions(+)
create mode 100644 arch/x86/include/asm/intel-family.h
From: Ben Hutchings <hidden> Date: 2018-03-12 03:41:54
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <redacted>
commit 65fc985b37dc241c4db7cd32adcbc989193fe3c8 upstream.
We add another 32-bit vector at the end of the ->x86_capability
bitvector which collects bugs present in CPUs. After all, a CPU bug is a
kind of a capability, albeit a strange one.
Signed-off-by: Borislav Petkov <redacted>
Link: http://lkml.kernel.org/r/1363788448-31325-2-git-send-email-bp@alien8.de
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/cpufeature.h | 13 +++++++++++++
arch/x86/include/asm/processor.h | 2 +-
arch/x86/kernel/alternative.c | 2 +-
arch/x86/kernel/cpu/common.c | 4 ++++
4 files changed, 19 insertions(+), 2 deletions(-)
@@ -7,6 +7,7 @@#include<asm/required-features.h>#define NCAPINTS 10 /* N 32-bit words worth of info */+#define NBUGINTS 1 /* N 32-bit bug flags *//**Note:Ifthecommentbeginswithaquotedstring,thatstringisused
@@ -86,7 +86,7 @@ struct cpuinfo_x86 {__u32extended_cpuid_level;/* Maximum supported CPUID level, -1=no CPUID: */intcpuid_level;-__u32x86_capability[NCAPINTS];+__u32x86_capability[NCAPINTS+NBUGINTS];charx86_vendor_id[16];charx86_model_id[64];/* in KB - valid for CPUS which support this call: */---a/arch/x86/kernel/alternative.c+++b/arch/x86/kernel/alternative.c
@@ -954,6 +954,10 @@ static void __cpuinit identify_cpu(struc/* AND the already accumulated flags with these */for(i=0;i<NCAPINTS;i++)boot_cpu_data.x86_capability[i]&=c->x86_capability[i];++/* OR, i.e. replicate the bug flags */+for(i=NCAPINTS;i<NCAPINTS+NBUGINTS;i++)+c->x86_capability[i]|=boot_cpu_data.x86_capability[i];}/* Init Machine Check Exception if available. */
From: Ben Hutchings <hidden> Date: 2018-03-12 03:41:55
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <redacted>
commit 22085a66c2fab6cf9b9393c056a3600a6b4735de upstream.
We very often need to set or clear a bit in an MSR as a result of doing
some sort of a hardware configuration. Add generic versions of that
repeated functionality in order to save us a bunch of duplicated code in
the early CPU vendor detection/config code.
Signed-off-by: Borislav Petkov <redacted>
Link: http://lkml.kernel.org/r/1394384725-10796-2-git-send-email-bp@alien8.de
Signed-off-by: H. Peter Anvin <redacted>
[bwh: Backported to 3.2: s/wrmsrl_safe/checking_wrmsrl/]
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/msr.h | 2 ++
arch/x86/lib/msr.c | 89 +++++++++++++++++++++++++++++++++++++++++++++-
2 files changed, 90 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2018-03-12 03:41:57
3.2.101-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <redacted>
commit dbe4058a6a44af4ca5d146aebe01b0a1f9b7fd2a upstream.
Quentin caught a corner case with the generation of instruction
padding in the ALTERNATIVE_2 macro: if len(orig_insn) <
len(alt1) < len(alt2), then not enough padding gets added and
that is not good(tm) as we could overwrite the beginning of the
next instruction.
Luckily, at the time of this writing, we don't have
ALTERNATIVE_2() invocations which have that problem and even if
we did, a simple fix would be to prepend the instructions with
enough prefixes so that that corner case doesn't happen.
However, best it would be if we fixed it properly. See below for
a simple, abstracted example of what we're doing.
So what we ended up doing is, we compute the
max(len(alt1), len(alt2)) - len(orig_insn)
and feed that value to the .skip gas directive. The max() cannot
have conditionals due to gas limitations, thus the fancy integer
math.
With this patch, all ALTERNATIVE_2 sites get padded correctly;
generating obscure test cases pass too:
#define alt_max_short(a, b) ((a) ^ (((a) ^ (b)) & -(-((a) < (b)))))
#define gen_skip(orig, alt1, alt2, marker) \
.skip -((alt_max_short(alt1, alt2) - (orig)) > 0) * \
(alt_max_short(alt1, alt2) - (orig)),marker
.pushsection .text, "ax"
.globl main
main:
gen_skip(1, 2, 4, 0x09)
gen_skip(4, 1, 2, 0x10)
...
.popsection
Thanks to Quentin for catching it and double-checking the fix!
Reported-by: Quentin Casasnovas <redacted>
Signed-off-by: Borislav Petkov <redacted>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <redacted>
Cc: Denys Vlasenko <redacted>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Thomas Gleixner <redacted>
Link: http://lkml.kernel.org/r/20150404133443.GE21152@pd.tnic
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/include/asm/alternative-asm.h | 14 ++++++++++++--
arch/x86/include/asm/alternative.h | 16 ++++++++++++----
arch/x86/kernel/alternative.c | 4 ++--
3 files changed, 26 insertions(+), 8 deletions(-)