x86 fixes
Subsystems (7)
Linus,
Please pull the latest x86-urgent-for-linus git tree from:
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86-urgent-for-linus
# HEAD: 9d8d0294e78a164d407133dea05caf4b84247d6a x86/speculation/mds: Improve CPU buffer clear documentation
Misc fixes and updates:
- a handful of MDS documentation/comment updates
- a cleanup related to hweight interfaces
- a SEV guest fix for large pages
- a kprobes LTO fix
- and a final cleanup commit for vDSO HPET support removal.
out-of-topic modifications in x86-urgent-for-linus:
-----------------------------------------------------
lib/hweight.c # 409ca45526a4: x86/kconfig: Disable CONFIG_
Thanks,
Ingo
------------------>
Andi Kleen (1):
x86/kprobes: Make trampoline_handler() global and visible
Andy Lutomirski (2):
x86/speculation/mds: Revert CPU buffer clear on double fault exit x86/speculation/mds: Improve CPU buffer clear documentation
Brijesh Singh (1):
x86/mm: Do not use set_{pud, pmd}_safe() when splitting a large page
Jia Zhang (1):
x86/vdso: Remove hpet_page from vDSO
Masahiro Yamada (1):
x86/kconfig: Disable CONFIG_GENERIC_HWEIGHT and remove __HAVE_ARCH_SW_HWEIGHT
Documentation/x86/mds.rst | 44 ++--------- arch/x86/Kconfig | 3 - arch/x86/entry/vdso/vdso2c.c | 3 - arch/x86/include/asm/arch_hweight.h | 2 - arch/x86/include/asm/vdso.h | 1 - arch/x86/kernel/kprobes/core.c | 2 +- arch/x86/kernel/traps.c | 8 -- arch/x86/mm/init_64.c | 144 ++++++++++++++++++++++++++---------- arch/x86/mm/mem_encrypt.c | 10 ++- arch/x86/mm/mm_internal.h | 3 + lib/hweight.c | 4 - 11 files changed, 121 insertions(+), 103 deletions(-)
Documentation/x86/mds.rst +6 -38
@@ -142,45 +142,13 @@ Mitigation points mds_user_clear. The mitigation is invoked in prepare_exit_to_usermode() which covers - most of the kernel to user space transitions. There are a few exceptions - which are not invoking prepare_exit_to_usermode() on return to user - space. These exceptions use the paranoid exit code. + all but one of the kernel to user space transitions. The exception + is when we return from a Non Maskable Interrupt (NMI), which is + handled directly in do_nmi(). - - Non Maskable Interrupt (NMI): - - Access to sensible data like keys, credentials in the NMI context is - mostly theoretical: The CPU can do prefetching or execute a - misspeculated code path and thereby fetching data which might end up - leaking through a buffer. - - But for mounting other attacks the kernel stack address of the task is - already valuable information. So in full mitigation mode, the NMI is - mitigated on the return from do_nmi() to provide almost complete - coverage. - - - Double fault (#DF): - - A double fault is usually fatal, but the ESPFIX workaround, which can - be triggered from user space through modify_ldt(2) is a recoverable - double fault. #DF uses the paranoid exit path, so explicit mitigation - in the double fault handler is required. - - - Machine Check Exception (#MC): - - Another corner case is a #MC which hits between the CPU buffer clear - invocation and the actual return to user. As this still is in kernel - space it takes the paranoid exit path which does not clear the CPU - buffers. So the #MC handler repopulates the buffers to some - extent. Machine checks are not reliably controllable and the window is - extremly small so mitigation would just tick a checkbox that this - theoretical corner case is covered. To keep the amount of special - cases small, ignore #MC. - - - Debug Exception (#DB): - - This takes the paranoid exit path only when the INT1 breakpoint is in - kernel space. #DB on a user space address takes the regular exit path, - so no extra mitigation required. + (The reason that NMI is special is that prepare_exit_to_usermode() can + enable IRQs. In NMI context, NMIs are blocked, and we don't want to + enable IRQs with NMIs blocked.) 2. C-State transition
arch/x86/Kconfig +0 -3
@@ -259,9 +259,6 @@ config GENERIC_BUG config GENERIC_BUG_RELATIVE_POINTERS bool -config GENERIC_HWEIGHT - def_bool y - config ARCH_MAY_HAVE_PC_FDC def_bool y depends on ISA_DMA_API
arch/x86/entry/vdso/vdso2c.c +0 -3
@@ -73,14 +73,12 @@ const char *outfilename;enum { sym_vvar_start, sym_vvar_page, - sym_hpet_page, sym_pvclock_page, sym_hvclock_page, };const int special_pages[] = { sym_vvar_page, - sym_hpet_page, sym_pvclock_page, sym_hvclock_page, };
@@ -93,7 +91,6 @@ struct vdso_sym {struct vdso_sym required_syms[] = { [sym_vvar_start] = {"vvar_start" , true}, [sym_vvar_page] = {"vvar_page" , true}, - [sym_hpet_page] = {"hpet_page" , true}, [sym_pvclock_page] = {"pvclock_page" , true}, [sym_hvclock_page] = {"hvclock_page" , true}, {"VDSO32_NOTE_MASK" , true},
arch/x86/include/asm/arch_hweight.h +0 -2
@@ -12,8 +12,6 @@#define REG_OUT "a"#endif -#define __HAVE_ARCH_SW_HWEIGHT - static __always_inline unsigned int __arch_hweight32(unsigned int w) {unsigned int res;
arch/x86/include/asm/vdso.h +0 -1
@@ -19,7 +19,6 @@ struct vdso_image {long sym_vvar_start;/* Negative offset to the vvar area */ long sym_vvar_page; -long sym_hpet_page;long sym_pvclock_page;long sym_hvclock_page;long sym_VDSO32_NOTE_MASK;
arch/x86/kernel/kprobes/core.c +1 -1
@@ -768,7 +768,7 @@ static struct kprobe kretprobe_kprobe = {/* * Called from kretprobe_trampoline */ -static __used void *trampoline_handler (struct pt_regs *regs) +__used __visible void *trampoline_handler(struct pt_regs *regs) {struct kprobe_ctlblk *kcb;struct kretprobe_instance *ri =NULL ;
arch/x86/kernel/traps.c +0 -8
@@ -58,7 +58,6 @@#include <asm/alternative.h> #include <asm/fpu/xstate.h> #include <asm/trace/mpx.h> -#include <asm/nospec-branch.h> #include <asm/mpx.h> #include <asm/vm86.h> #include <asm/umip.h>
@@ -368,13 +367,6 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code) regs->ip = (unsigned long )general_protection; regs->sp = (unsigned long )&gpregs->orig_ax; -/* -* This situation can be triggered by userspace via -* modify_ldt(2) and the return does not take the regular -* user space exit, so a CPU buffer clear is required when -* MDS mitigation is enabled. -*/ -mds_user_clear_cpu_buffers (); return; }#endif
arch/x86/mm/init_64.c +104 -40
289 lines not on this page · raw message
arch/x86/mm/mem_encrypt.c +7 -3
@@ -301,9 +301,13 @@ static int __init early_set_memory_enc_dec(unsigned long vaddr,else split_page_size_mask =1 <<PG_LEVEL_2M ; -kernel_physical_mapping_init (__pa (vaddr & pmask), -__pa ((vaddr_end & pmask) + psize), - split_page_size_mask); +/* +* kernel_physical_mapping_change() does not flush the TLBs, so +* a TLB flush is required after we exit from the for loop. +*/ +kernel_physical_mapping_change (__pa (vaddr & pmask), +__pa ((vaddr_end & pmask) + psize), + split_page_size_mask); } ret =0 ;
arch/x86/mm/mm_internal.h +3 -0
@@ -13,6 +13,9 @@ void early_ioremap_page_table_range_init(void);unsigned long kernel_physical_mapping_init (unsigned long start,unsigned long end,unsigned long page_size_mask); +unsigned long kernel_physical_mapping_change (unsigned long start, +unsigned long end, +unsigned long page_size_mask);void zone_sizes_init (void );extern int after_bootmem;
lib/hweight.c +0 -4
@@ -10,7 +10,6 @@* The Hamming Weight of a number is the total number of bits set in it. */ -#ifndef __HAVE_ARCH_SW_HWEIGHTunsigned int __sw_hweight32 (unsigned int w) {#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
@@ -27,7 +26,6 @@ unsigned int __sw_hweight32(unsigned int w)#endif }EXPORT_SYMBOL (__sw_hweight32); -#endif unsigned int __sw_hweight16 (unsigned int w) {
@@ -46,7 +44,6 @@ unsigned int __sw_hweight8(unsigned int w) }EXPORT_SYMBOL (__sw_hweight8); -#ifndef __HAVE_ARCH_SW_HWEIGHTunsigned long __sw_hweight64 (__u64 w) {#if BITS_PER_LONG ==32
@@ -69,4 +66,3 @@ unsigned long __sw_hweight64(__u64 w)#endif }EXPORT_SYMBOL (__sw_hweight64); -#endif
The pull request you sent on Thu, 16 May 2019 18:26:16 +0200:
The pull request you sent on Thu, 16 May 2019 18:26:16 +0200:
Quoted 1 line
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.gitx86-urgent-for-linus
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/d396360acdf7e57edcd9e2d080343b0353d65d63
Thank you!
Signature · 2 lines
Deet-doot-dot, I am a bot. https://korg.wiki.kernel.org/userdoc/prtracker