All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jiri Slaby <jslaby@suse.cz>
To: stable@vger.kernel.org
Cc: linux-kernel@vger.kernel.org,
	Andrew Cooper <andrew.cooper3@citrix.com>,
	Rusty Russell <rusty@rustcorp.com.au>,
	Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>,
	lguest@lists.ozlabs.org, Xen-devel <xen-devel@lists.xen.org>,
	Thomas Gleixner <tglx@linutronix.de>, Jiri Slaby <jslaby@suse.cz>
Subject: [PATCH 3.12 28/91] x86/cpu: Fix SMAP check in PVOPS environments
Date: Tue,  5 Jan 2016 18:46:12 +0100	[thread overview]
Message-ID: <6119d48728f749093c1b7a2ec18a125252756a5d.1452015822.git.jslaby@suse.cz> (raw)
In-Reply-To: <ba880cfbf85370a46062a2894a70d35260f26f2b.1452015821.git.jslaby@suse.cz>
In-Reply-To: <cover.1452015821.git.jslaby@suse.cz>

From: Andrew Cooper <andrew.cooper3@citrix.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 581b7f158fe0383b492acd1ce3fb4e99d4e57808 upstream.

There appears to be no formal statement of what pv_irq_ops.save_fl() is
supposed to return precisely.  Native returns the full flags, while lguest and
Xen only return the Interrupt Flag, and both have comments by the
implementations stating that only the Interrupt Flag is looked at.  This may
have been true when initially implemented, but no longer is.

To make matters worse, the Xen PVOP leaves the upper bits undefined, making
the BUG_ON() undefined behaviour.  Experimentally, this now trips for 32bit PV
guests on Broadwell hardware.  The BUG_ON() is consistent for an individual
build, but not consistent for all builds.  It has also been a sitting timebomb
since SMAP support was introduced.

Use native_save_fl() instead, which will obtain an accurate view of the AC
flag.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Tested-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <lguest@lists.ozlabs.org>
Cc: Xen-devel <xen-devel@lists.xen.org>
Link: http://lkml.kernel.org/r/1433323874-6927-1-git-send-email-andrew.cooper3@citrix.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/kernel/cpu/common.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 6db4828574ef..9364936b47c2 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -280,10 +280,9 @@ __setup("nosmap", setup_disable_smap);
 
 static __always_inline void setup_smap(struct cpuinfo_x86 *c)
 {
-	unsigned long eflags;
+	unsigned long eflags = native_save_fl();
 
 	/* This should have been cleared long ago */
-	raw_local_save_flags(eflags);
 	BUG_ON(eflags & X86_EFLAGS_AC);
 
 	if (cpu_has(c, X86_FEATURE_SMAP)) {
-- 
2.6.4


WARNING: multiple messages have this Message-ID
From: Jiri Slaby <jslaby@suse.cz>
To: stable@vger.kernel.org
Cc: lguest@lists.ozlabs.org,
	Andrew Cooper <andrew.cooper3@citrix.com>,
	Rusty Russell <rusty@rustcorp.com.au>,
	linux-kernel@vger.kernel.org, Xen-devel <xen-devel@lists.xen.org>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>,
	Jiri Slaby <jslaby@suse.cz>, Thomas Gleixner <tglx@linutronix.de>
Subject: [PATCH 3.12 28/91] x86/cpu: Fix SMAP check in PVOPS environments
Date: Tue,  5 Jan 2016 18:46:12 +0100	[thread overview]
Message-ID: <6119d48728f749093c1b7a2ec18a125252756a5d.1452015822.git.jslaby@suse.cz> (raw)
In-Reply-To: <ba880cfbf85370a46062a2894a70d35260f26f2b.1452015821.git.jslaby@suse.cz>
In-Reply-To: <cover.1452015821.git.jslaby@suse.cz>

From: Andrew Cooper <andrew.cooper3@citrix.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 581b7f158fe0383b492acd1ce3fb4e99d4e57808 upstream.

There appears to be no formal statement of what pv_irq_ops.save_fl() is
supposed to return precisely.  Native returns the full flags, while lguest and
Xen only return the Interrupt Flag, and both have comments by the
implementations stating that only the Interrupt Flag is looked at.  This may
have been true when initially implemented, but no longer is.

To make matters worse, the Xen PVOP leaves the upper bits undefined, making
the BUG_ON() undefined behaviour.  Experimentally, this now trips for 32bit PV
guests on Broadwell hardware.  The BUG_ON() is consistent for an individual
build, but not consistent for all builds.  It has also been a sitting timebomb
since SMAP support was introduced.

Use native_save_fl() instead, which will obtain an accurate view of the AC
flag.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Tested-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <lguest@lists.ozlabs.org>
Cc: Xen-devel <xen-devel@lists.xen.org>
Link: http://lkml.kernel.org/r/1433323874-6927-1-git-send-email-andrew.cooper3@citrix.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/kernel/cpu/common.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 6db4828574ef..9364936b47c2 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -280,10 +280,9 @@ __setup("nosmap", setup_disable_smap);
 
 static __always_inline void setup_smap(struct cpuinfo_x86 *c)
 {
-	unsigned long eflags;
+	unsigned long eflags = native_save_fl();
 
 	/* This should have been cleared long ago */
-	raw_local_save_flags(eflags);
 	BUG_ON(eflags & X86_EFLAGS_AC);
 
 	if (cpu_has(c, X86_FEATURE_SMAP)) {
-- 
2.6.4

  parent reply	other threads:[~2016-01-05 18:08 UTC|newest]

Thread overview: 113+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-05 17:46 [PATCH 3.12 00/91] 3.12.52-stable review Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 01/91] ipv6: fix tunnel error handling Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 02/91] MIPS: KVM: Fix ASID restoration logic Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 03/91] MIPS: KVM: Fix CACHE immediate offset sign extension Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 04/91] MIPS: KVM: Uninit VCPU in vcpu_create error path Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 05/91] unix: avoid use-after-free in ep_remove_wait_queue Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 06/91] packet: do skb_probe_transport_header when we actually have data Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 07/91] packet: infer protocol from ethernet header if unset Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 08/91] sctp: translate host order to network order when setting a hmacid Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 09/91] snmp: Remove duplicate OUTMCAST stat increment Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 10/91] net: qmi_wwan: add XS Stick W100-2 from 4G Systems Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 11/91] tcp: md5: fix lockdep annotation Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 12/91] tcp: initialize tp->copied_seq in case of cross SYN connection Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 13/91] net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 14/91] net: ipmr: fix static mfc/dev leaks on table destruction Jiri Slaby
2016-01-05 17:45 ` [PATCH 3.12 15/91] net: ip6mr: " Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 16/91] broadcom: fix PHY_ID_BCM5481 entry in the id table Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 17/91] ipv6: distinguish frag queues by device for multicast and link-local packets Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 18/91] ipv6: add complete rcu protection around np->opt Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 19/91] net/neighbour: fix crash at dumping device-agnostic proxy entries Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 20/91] ipv6: sctp: implement sctp_v6_destroy_sock() Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 21/91] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 22/91] ARM: 8426/1: dma-mapping: add missing range check in dma_mmap() Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 23/91] ARM: 8427/1: dma-mapping: add support for offset parameter " Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 24/91] ARM: common: edma: Fix channel parameter for irq callbacks Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 25/91] x86/setup: Extend low identity map to cover whole kernel range Jiri Slaby
2016-01-06 10:47   ` Paolo Bonzini
2016-01-06 11:00     ` Matt Fleming
2016-01-06 11:24       ` Luis Henriques
2016-01-06 11:24         ` Luis Henriques
2016-01-06 13:31         ` Matt Fleming
2016-01-06 14:22           ` Luis Henriques
2016-01-06 14:22             ` Luis Henriques
2016-01-08 11:56             ` Matt Fleming
2016-01-08 13:36               ` Luis Henriques
2016-01-08 13:36                 ` Luis Henriques
2016-01-09  7:09             ` Jiri Slaby
2016-01-14 20:51             ` Kamal Mostafa
2016-01-05 17:46 ` [PATCH 3.12 26/91] x86/setup: Fix low identity map for >= 2GB " Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 27/91] x86/cpu: Call verify_cpu() after having entered long mode too Jiri Slaby
2016-01-05 17:46 ` Jiri Slaby [this message]
2016-01-05 17:46   ` [PATCH 3.12 28/91] x86/cpu: Fix SMAP check in PVOPS environments Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 29/91] mac80211: fix driver RSSI event calculations Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 30/91] net: mvneta: Fix CPU_MAP registers initialisation Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 31/91] mwifiex: fix mwifiex_rdeeprom_read() Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 32/91] staging: rtl8712: Add device ID for Sitecom WLA2100 Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 33/91] Bluetooth: hidp: fix device disconnect on idle timeout Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 34/91] Bluetooth: ath3k: Add new AR3012 0930:021c id Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 35/91] Bluetooth: ath3k: Add support of AR3012 0cf3:817b device Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 36/91] can: sja1000: clear interrupts on start Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 37/91] arm64: Fix compat register mappings Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 38/91] usblp: do not set TASK_INTERRUPTIBLE before lock Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 39/91] usb: musb: core: fix order of arguments to ulpi write callback Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 40/91] USB: ti_usb_3410_5052: Add Honeywell HGI80 ID Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 41/91] USB: serial: option: add support for Novatel MiFi USB620L Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 42/91] USB: option: add XS Stick W100-2 from 4G Systems Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 43/91] ALSA: usb-audio: add packet size quirk for the Medeli DD305 Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 44/91] ALSA: usb-audio: prevent CH345 multiport output SysEx corruption Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 45/91] ALSA: usb-audio: work around CH345 input " Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 46/91] tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 47/91] module: Call module notifier on failure after complete_formation() Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 48/91] netfilter: ipt_rpfilter: remove the nh_scope test in rpfilter_lookup_reverse Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 49/91] netfilter: ip6t_SYNPROXY: fix NULL pointer dereference Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 50/91] firewire: core: use correct vendor/model IDs Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 51/91] ip6mr: call del_timer_sync() in ip6mr_free_table() Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 52/91] Btrfs: fix race leading to incorrect item deletion when dropping extents Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 53/91] Btrfs: fix race leading to BUG_ON when running delalloc for nodatacow Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 54/91] ext4: fix potential use after free in __ext4_journal_stop Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 55/91] ext4, jbd2: ensure entering into panic after recording an error in superblock Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 56/91] firewire: ohci: fix JMicron JMB38x IT context discovery Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 57/91] nfs4: start callback_ident at idr 1 Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 58/91] nfs: if we have no valid attrs, then don't declare the attribute cache valid Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 59/91] ocfs2: fix umask ignored issue Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 60/91] USB: cdc_acm: Ignore Infineon Flash Loader utility Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 61/91] USB: serial: Another Infineon flash loader USB ID Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 62/91] USB: cp210x: Remove CP2110 ID from compatibility list Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 63/91] USB: add quirk for devices with broken LPM Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 64/91] USB: whci-hcd: add check for dma mapping error Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 65/91] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 66/91] gre6: allow to update all parameters via rtnl Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 67/91] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 68/91] sctp: use the same clock as if sock source timestamps were on Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 69/91] sctp: update the netstamp_needed counter when copying sockets Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 70/91] ipv6: sctp: clone options to avoid use after free Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 71/91] net: add validation for the socket syscall protocol argument Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 72/91] sh_eth: fix kernel oops in skb_put() Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 73/91] net: fix IP early demux races Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 74/91] vlan: Fix untag operations of stacked vlans with REORDER_HEADER off Jiri Slaby
2016-01-05 17:46 ` [PATCH 3.12 75/91] skbuff: Fix offset error in skb_reorder_vlan_header Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 76/91] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 77/91] bluetooth: Validate socket address length in sco_sock_bind() Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 78/91] af_unix: Revert 'lock_interruptible' in stream receive code Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 79/91] x86/setup: Do not reserve crashkernel high memory if low reservation failed Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 80/91] ahci: Add Marvell 88se91a2 device id Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 81/91] ahci: add new Intel device IDs Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 82/91] target/stat: print full t10_wwn.model buffer Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 83/91] RDS: fix race condition when sending a message on unbound socket Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 84/91] ALSA: hda - Disable 64bit address for Creative HDA controllers Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 85/91] i2c: i801: Add support for Intel Broxton Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 86/91] i2c: i801: add Intel Lewisburg device IDs Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 87/91] cdrom: Random writing support for BD-RE media Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 88/91] PM / devfreq: Fix governor_store() Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 89/91] PM / devfreq: Fix incorrect type issue Jiri Slaby
2016-11-12  3:02   ` Ben Hutchings
2016-11-12  4:11     ` Willy Tarreau
2016-11-12  4:11       ` Willy Tarreau
2016-01-05 17:47 ` [PATCH 3.12 90/91] gpio/omap: raw read and write endian fix Jiri Slaby
2016-01-05 17:47 ` [PATCH 3.12 91/91] HID: dragonrise: fix HID Descriptor for 0x0006 PID Jiri Slaby
2016-01-05 20:47 ` [PATCH 3.12 00/91] 3.12.52-stable review Guenter Roeck
2016-01-09  8:47   ` Jiri Slaby
2016-01-05 21:18 ` Shuah Khan
2016-01-06  7:37 ` Nikolay Borisov
2016-01-06  8:14   ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6119d48728f749093c1b7a2ec18a125252756a5d.1452015822.git.jslaby@suse.cz \
    --to=jslaby@suse.cz \
    --cc=andrew.cooper3@citrix.com \
    --cc=boris.ostrovsky@oracle.com \
    --cc=konrad.wilk@oracle.com \
    --cc=lguest@lists.ozlabs.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=rusty@rustcorp.com.au \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=xen-devel@lists.xen.org \
    --subject='Re: [PATCH 3.12 28/91] x86/cpu: Fix SMAP check in PVOPS environments' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.