iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Browse Source 
Pull x86 fixes from Thomas Gleixner:
 "A set of fixes for x86:

   - Fix the bogus detection of 32bit user mode for uretprobes which
     caused corruption of the user return address resulting in
     application crashes. In the uprobes handler in_ia32_syscall() is
     obviously always returning false on a 64bit kernel. Use
     user_64bit_mode() instead which works correctly.

   - Prevent large page splitting when ftrace flips RW/RO on the kernel
     text which caused iTLB performance issues. Ftrace wants to be
     converted to text_poke() which avoids the problem, but for now
     allow large page preservation in the static protections check when
     the change request spawns a full large page.

   - Prevent arch_dynirq_lower_bound() from returning 0 when the IOAPIC
     is configured via device tree. In the device tree case the GSI 1:1
     mapping is meaningless therefore the lower bound which protects the
     GSI range on ACPI machines is irrelevant. Return the lower bound
     which the core hands to the function instead of blindly returning 0
     which causes the core to allocate the invalid virtual interupt
     number 0 which in turn prevents all drivers from allocating and
     requesting an interrupt.

   - Remove the bogus initialization of LDR and DFR in the 32bit bigsmp
     APIC driver. That uses physical destination mode where LDR/DFR are
     ignored, but the initialization and the missing clear of LDR caused
     the APIC to be left in a inconsistent state on kexec/reboot.

   - Clear LDR when clearing the APIC registers so the APIC is in a well
     defined state.

   - Initialize variables proper in the find_trampoline_placement()
     code.

   - Silence GCC( build warning for the real mode part of the build"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/mm/cpa: Prevent large page split when ftrace flips RW on kernel text
  x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning
  x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement()
  x86/apic: Include the LDR when clearing out APIC registers
  x86/apic: Do not initialize LDR and DFR for bigsmp
  uprobes/x86: Fix detection of 32-bit user mode
  x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
This commit is contained in:
Linus Torvalds 2019-09-01 11:21:57 -07:00
commit 9f159ae07f
7 changed files with 43 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
arch/x86/Makefile
View File

@ -38,6 +38,7 @@ REALMODE_CFLAGS := $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING \
REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -ffreestanding)
REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -fno-stack-protector)
REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -Wno-address-of-packed-member)
REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), $(cc_stack_align4))
export REALMODE_CFLAGS

2
arch/x86/boot/compressed/pgtable_64.c
View File

@ -72,7 +72,7 @@ static unsigned long find_trampoline_placement(void)
/* Find the first usable memory region under bios_start. */
for (i = boot_params->e820_entries - 1; i >= 0; i--) {
unsigned long new;
unsigned long new = bios_start;
entry = &boot_params->e820_table[i];

4
arch/x86/kernel/apic/apic.c
View File

@ -1179,6 +1179,10 @@ void clear_local_APIC(void)
apic_write(APIC_LVT0, v | APIC_LVT_MASKED);
v = apic_read(APIC_LVT1);
apic_write(APIC_LVT1, v | APIC_LVT_MASKED);
if (!x2apic_enabled()) {
v = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
apic_write(APIC_LDR, v);
}
if (maxlvt >= 4) {
v = apic_read(APIC_LVTPC);
apic_write(APIC_LVTPC, v | APIC_LVT_MASKED);

24
arch/x86/kernel/apic/bigsmp_32.c
View File

@ -38,32 +38,12 @@ static int bigsmp_early_logical_apicid(int cpu)
return early_per_cpu(x86_cpu_to_apicid, cpu);
}
static inline unsigned long calculate_ldr(int cpu)
{
unsigned long val, id;
val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
id = per_cpu(x86_bios_cpu_apicid, cpu);
val |= SET_APIC_LOGICAL_ID(id);
return val;
}
/*
* Set up the logical destination ID.
*
* Intel recommends to set DFR, LDR and TPR before enabling
* an APIC. See e.g. "AP-388 82489DX User's Manual" (Intel
* document number 292116). So here it goes...
* bigsmp enables physical destination mode
* and doesn't use LDR and DFR
*/
static void bigsmp_init_apic_ldr(void)
{
unsigned long val;
int cpu = smp_processor_id();
apic_write(APIC_DFR, APIC_DFR_FLAT);
val = calculate_ldr(cpu);
apic_write(APIC_LDR, val);
}
static void bigsmp_setup_apic_routing(void)

8
arch/x86/kernel/apic/io_apic.c
View File

@ -2438,7 +2438,13 @@ unsigned int arch_dynirq_lower_bound(unsigned int from)
* dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use
* gsi_top if ioapic_dynirq_base hasn't been initialized yet.
*/
return ioapic_initialized ? ioapic_dynirq_base : gsi_top;
if (!ioapic_initialized)
return gsi_top;
/*
* For DT enabled machines ioapic_dynirq_base is irrelevant and not
* updated. So simply return @from if ioapic_dynirq_base == 0.
*/
return ioapic_dynirq_base ? : from;
}
#ifdef CONFIG_X86_32

17
arch/x86/kernel/uprobes.c
View File

@ -508,9 +508,12 @@ struct uprobe_xol_ops {
void (*abort)(struct arch_uprobe *, struct pt_regs *);
};
static inline int sizeof_long(void)
static inline int sizeof_long(struct pt_regs *regs)
{
return in_ia32_syscall() ? 4 : 8;
/*
* Check registers for mode as in_xxx_syscall() does not apply here.
*/
return user_64bit_mode(regs) ? 8 : 4;
}
static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
@ -521,9 +524,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
{
unsigned long new_sp = regs->sp - sizeof_long();
unsigned long new_sp = regs->sp - sizeof_long(regs);
if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
if (copy_to_user((void __user *)new_sp, &val, sizeof_long(regs)))
return -EFAULT;
regs->sp = new_sp;
@ -556,7 +559,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
long correction = utask->vaddr - utask->xol_vaddr;
regs->ip += correction;
} else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
regs->sp += sizeof_long(); /* Pop incorrect return address */
regs->sp += sizeof_long(regs); /* Pop incorrect return address */
if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
return -ERESTART;
}
@ -675,7 +678,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
* "call" insn was executed out-of-line. Just restore ->sp and restart.
* We could also restore ->ip and try to call branch_emulate_op() again.
*/
regs->sp += sizeof_long();
regs->sp += sizeof_long(regs);
return -ERESTART;
}
@ -1056,7 +1059,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
unsigned long
arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
{
int rasize = sizeof_long(), nleft;
int rasize = sizeof_long(regs), nleft;
unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))

26
arch/x86/mm/pageattr.c
View File

@ -516,7 +516,7 @@ static inline void check_conflict(int warnlvl, pgprot_t prot, pgprotval_t val,
*/
static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
unsigned long pfn, unsigned long npg,
int warnlvl)
unsigned long lpsize, int warnlvl)
{
pgprotval_t forbidden, res;
unsigned long end;
@ -535,9 +535,17 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
check_conflict(warnlvl, prot, res, start, end, pfn, "Text NX");
forbidden = res;
res = protect_kernel_text_ro(start, end);
check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO");
forbidden |= res;
/*
* Special case to preserve a large page. If the change spawns the
* full large page mapping then there is no point to split it
* up. Happens with ftrace and is going to be removed once ftrace
* switched to text_poke().
*/
if (lpsize != (npg * PAGE_SIZE) || (start & (lpsize - 1))) {
res = protect_kernel_text_ro(start, end);
check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO");
forbidden |= res;
}
/* Check the PFN directly */
res = protect_pci_bios(pfn, pfn + npg - 1);
@ -819,7 +827,7 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
* extra conditional required here.
*/
chk_prot = static_protections(old_prot, lpaddr, old_pfn, numpages,
CPA_CONFLICT);
psize, CPA_CONFLICT);
if (WARN_ON_ONCE(pgprot_val(chk_prot) != pgprot_val(old_prot))) {
/*
@ -855,7 +863,7 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
* protection requirement in the large page.
*/
new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages,
CPA_DETECT);
psize, CPA_DETECT);
/*
* If there is a conflict, split the large page.
@ -906,7 +914,8 @@ static void split_set_pte(struct cpa_data *cpa, pte_t *pte, unsigned long pfn,
if (!cpa->force_static_prot)
goto set;
prot = static_protections(ref_prot, address, pfn, npg, CPA_PROTECT);
/* Hand in lpsize = 0 to enforce the protection mechanism */
prot = static_protections(ref_prot, address, pfn, npg, 0, CPA_PROTECT);
if (pgprot_val(prot) == pgprot_val(ref_prot))
goto set;
@ -1503,7 +1512,8 @@ repeat:
pgprot_val(new_prot) |= pgprot_val(cpa->mask_set);
cpa_inc_4k_install();
new_prot = static_protections(new_prot, address, pfn, 1,
/* Hand in lpsize = 0 to enforce the protection mechanism */
new_prot = static_protections(new_prot, address, pfn, 1, 0,
CPA_PROTECT);
new_prot = pgprot_clear_protnone_bits(new_prot);