All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jiri Slaby <jslaby@suse.cz>
To: stable@vger.kernel.org
Cc: Borislav Petkov <bp@suse.de>,
	Matt Fleming <matt@codeblueprint.co.uk>,
	Peter Zijlstra <peterz@infradead.org>,
	Thomas Gleixner <tglx@linutronix.de>, Jiri Slaby <jslaby@suse.cz>
Subject: [patch added to the 3.12 stable tree] x86/cpu: Call verify_cpu() after having entered long mode too
Date: Tue,  5 Jan 2016 16:28:28 +0100	[thread overview]
Message-ID: <1452007726-3747-27-git-send-email-jslaby@suse.cz> (raw)
In-Reply-To: <1452007726-3747-1-git-send-email-jslaby@suse.cz>

From: Borislav Petkov <bp@suse.de>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit 04633df0c43d710e5f696b06539c100898678235 upstream.

When we get loaded by a 64-bit bootloader, kernel entry point is
startup_64 in head_64.S. We don't trust any and all bootloaders because
some will fiddle with CPU configuration so we go ahead and massage each
CPU into sanity again.

For example, some dell BIOSes have this XD disable feature which set
IA32_MISC_ENABLE[34] and disable NX. This might be some dumb workaround
for other OSes but Linux sure doesn't need it.

A similar thing is present in the Surface 3 firmware - see
https://bugzilla.kernel.org/show_bug.cgi?id=106051 - which sets this bit
only on the BSP:

  # rdmsr -a 0x1a0
  400850089
  850089
  850089
  850089

I know, right?!

There's not even an off switch in there.

So fix all those cases by sanitizing the 64-bit entry point too. For
that, make verify_cpu() callable in 64-bit mode also.

Requested-and-debugged-by: "H. Peter Anvin" <hpa@zytor.com>
Reported-and-tested-by: Bastien Nocera <bugzilla@hadess.net>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1446739076-21303-1-git-send-email-bp@alien8.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/kernel/head_64.S    |  8 ++++++++
 arch/x86/kernel/verify_cpu.S | 12 +++++++-----
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index a2dc0add72ed..761fd69df6d9 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -65,6 +65,9 @@ startup_64:
 	 * tables and then reload them.
 	 */
 
+	/* Sanitize CPU configuration */
+	call verify_cpu
+
 	/*
 	 * Compute the delta between the address I am compiled to run at and the
 	 * address I am actually running at.
@@ -174,6 +177,9 @@ ENTRY(secondary_startup_64)
 	 * after the boot processor executes this code.
 	 */
 
+	/* Sanitize CPU configuration */
+	call verify_cpu
+
 	movq	$(init_level4_pgt - __START_KERNEL_map), %rax
 1:
 
@@ -288,6 +294,8 @@ ENTRY(secondary_startup_64)
 	pushq	%rax		# target address in negative space
 	lretq
 
+#include "verify_cpu.S"
+
 #ifdef CONFIG_HOTPLUG_CPU
 /*
  * Boot CPU0 entry point. It's called from play_dead(). Everything has been set
diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
index b9242bacbe59..4cf401f581e7 100644
--- a/arch/x86/kernel/verify_cpu.S
+++ b/arch/x86/kernel/verify_cpu.S
@@ -34,10 +34,11 @@
 #include <asm/msr-index.h>
 
 verify_cpu:
-	pushfl				# Save caller passed flags
-	pushl	$0			# Kill any dangerous flags
-	popfl
+	pushf				# Save caller passed flags
+	push	$0			# Kill any dangerous flags
+	popf
 
+#ifndef __x86_64__
 	pushfl				# standard way to check for cpuid
 	popl	%eax
 	movl	%eax,%ebx
@@ -48,6 +49,7 @@ verify_cpu:
 	popl	%eax
 	cmpl	%eax,%ebx
 	jz	verify_cpu_no_longmode	# cpu has no cpuid
+#endif
 
 	movl	$0x0,%eax		# See if cpuid 1 is implemented
 	cpuid
@@ -130,10 +132,10 @@ verify_cpu_sse_test:
 	jmp	verify_cpu_sse_test	# try again
 
 verify_cpu_no_longmode:
-	popfl				# Restore caller passed flags
+	popf				# Restore caller passed flags
 	movl $1,%eax
 	ret
 verify_cpu_sse_ok:
-	popfl				# Restore caller passed flags
+	popf				# Restore caller passed flags
 	xorl %eax, %eax
 	ret
-- 
2.6.4


  parent reply	other threads:[~2016-01-05 15:30 UTC|newest]

Thread overview: 46+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-05 15:28 [patch added to the 3.12 stable tree] ipv6: fix tunnel error handling Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] MIPS: KVM: Fix ASID restoration logic Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] MIPS: KVM: Fix CACHE immediate offset sign extension Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] MIPS: KVM: Uninit VCPU in vcpu_create error path Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] unix: avoid use-after-free in ep_remove_wait_queue Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] packet: do skb_probe_transport_header when we actually have data Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] packet: infer protocol from ethernet header if unset Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] sctp: translate host order to network order when setting a hmacid Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] snmp: Remove duplicate OUTMCAST stat increment Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: qmi_wwan: add XS Stick W100-2 from 4G Systems Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] tcp: md5: fix lockdep annotation Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] tcp: initialize tp->copied_seq in case of cross SYN connection Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: ipmr: fix static mfc/dev leaks on table destruction Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: ip6mr: " Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] broadcom: fix PHY_ID_BCM5481 entry in the id table Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ipv6: distinguish frag queues by device for multicast and link-local packets Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ipv6: add complete rcu protection around np->opt Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net/neighbour: fix crash at dumping device-agnostic proxy entries Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ipv6: sctp: implement sctp_v6_destroy_sock() Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ARM: 8426/1: dma-mapping: add missing range check in dma_mmap() Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ARM: 8427/1: dma-mapping: add support for offset parameter " Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ARM: common: edma: Fix channel parameter for irq callbacks Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/setup: Extend low identity map to cover whole kernel range Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/setup: Fix low identity map for >= 2GB " Jiri Slaby
2016-01-05 15:28 ` Jiri Slaby [this message]
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/cpu: Fix SMAP check in PVOPS environments Jiri Slaby
2016-01-05 15:28 ` Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] mac80211: fix driver RSSI event calculations Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: mvneta: Fix CPU_MAP registers initialisation Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] mwifiex: fix mwifiex_rdeeprom_read() Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] staging: rtl8712: Add device ID for Sitecom WLA2100 Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: hidp: fix device disconnect on idle timeout Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: ath3k: Add new AR3012 0930:021c id Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: ath3k: Add support of AR3012 0cf3:817b device Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] can: sja1000: clear interrupts on start Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] arm64: Fix compat register mappings Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] usblp: do not set TASK_INTERRUPTIBLE before lock Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] usb: musb: core: fix order of arguments to ulpi write callback Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] USB: ti_usb_3410_5052: Add Honeywell HGI80 ID Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] USB: serial: option: add support for Novatel MiFi USB620L Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] USB: option: add XS Stick W100-2 from 4G Systems Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ALSA: usb-audio: add packet size quirk for the Medeli DD305 Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ALSA: usb-audio: prevent CH345 multiport output SysEx corruption Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ALSA: usb-audio: work around CH345 input " Jiri Slaby

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1452007726-3747-27-git-send-email-jslaby@suse.cz \
    --to=jslaby@suse.cz \
    --cc=bp@suse.de \
    --cc=matt@codeblueprint.co.uk \
    --cc=peterz@infradead.org \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --subject='Re: [patch added to the 3.12 stable tree] x86/cpu: Call verify_cpu() after having entered long mode too' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.