[GIT pull] irq/urgent for v6.3-rc1

[GIT pull] irq/urgent for v6.3-rc1

[Thomas Gleixner]

Linus,

please pull the latest irq/urgent branch from:

   git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq-urgent-2023-03-05

up to:  0fb7fb713461: genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced


A set of updates for the interrupt susbsystem:

  - Prevent possible NULL pointer derefences in irq_data_get_affinity_mask()
    and irq_domain_create_hierarchy().

  - Take the per device MSI lock before invoking code which relies
    on it being hold.

  - Make sure that MSI descriptors are unreferenced before freeing
    them. This was overlooked when the platform MSI code was converted to
    use core infrastructure and results in a fals positive warning.

  - Remove dead code in the MSI subsystem.

  - Clarify the documentation for pci_msix_free_irq().

  - More kobj_type constification.

Thanks,

	tglx

------------------>
Johan Hovold (21):
      genirq/msi: Drop dead domain name assignment

Juergen Gross (1):
      irqdomain: Add missing NULL pointer check in irq_domain_create_hierarchy()

Marc Zyngier (4):
      genirq/msi: Take the per-device MSI lock before validating the control structure

Reinette Chatre (1):
      PCI/MSI: Clarify usage of pci_msix_free_irq()

Sergey Shtylyov (1):
      genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()

Thomas Gleixner (1):
      genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced

Thomas Weißschuh (1):
      genirq/irqdesc: Make kobj_type structures constant

 drivers/base/platform-msi.c |    1 +
 drivers/pci/msi/api.c       |    4 ++--
 include/linux/msi.h         |    2 ++
 kernel/irq/ipi.c            |    8 ++++++--
 kernel/irq/irqdesc.c        |    4 ++--
 kernel/irq/irqdomain.c      |    3 ++-
 kernel/irq/msi.c            |   28 +++++++++++++++++++++++-----
 kernel/irq/msi.c            |    9 ++++++---
 8 files changed, 44 insertions(+), 15 deletions(-)

diff --git a/drivers/base/platform-msi.c b/drivers/base/platform-msi.c
index 5883e7634a2b..f37ad34c80ec 100644
--- a/drivers/base/platform-msi.c
+++ b/drivers/base/platform-msi.c
@@ -324,6 +324,7 @@ void platform_msi_device_domain_free(struct irq_domain *domain, unsigned int vir
 	struct platform_msi_priv_data *data = domain->host_data;
 
 	msi_lock_descs(data->dev);
+	msi_domain_depopulate_descs(data->dev, virq, nr_irqs);
 	irq_domain_free_irqs_common(domain, virq, nr_irqs);
 	msi_free_msi_descs_range(data->dev, virq, virq + nr_irqs - 1);
 	msi_unlock_descs(data->dev);
diff --git a/include/linux/msi.h b/include/linux/msi.h
index a112b913fff9..15dd71817996 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -631,6 +631,8 @@ int msi_domain_prepare_irqs(struct irq_domain *domain, struct device *dev,
 			    int nvec, msi_alloc_info_t *args);
 int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev,
 			     int virq, int nvec, msi_alloc_info_t *args);
+void msi_domain_depopulate_descs(struct device *dev, int virq, int nvec);
+
 struct irq_domain *
 __platform_msi_create_device_domain(struct device *dev,
 				    unsigned int nvec,
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index aa5b7eeeceb8..6522dfb2e49c 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1172,7 +1172,8 @@ struct irq_domain *irq_domain_create_hierarchy(struct irq_domain *parent,
 		domain = __irq_domain_create(fwnode, 0, ~0, 0, ops, host_data);
 
 	if (domain) {
-		domain->root = parent->root;
+		if (parent)
+			domain->root = parent->root;
 		domain->parent = parent;
 		domain->flags |= flags;
 
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
index 13d96495e6d0..d169ee0c1799 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -830,11 +830,8 @@ static struct irq_domain *__msi_create_irq_domain(struct fwnode_handle *fwnode,
 	domain = irq_domain_create_hierarchy(parent, flags | IRQ_DOMAIN_FLAG_MSI, 0,
 					     fwnode, &msi_domain_ops, info);
 
-	if (domain) {
-		if (!domain->name && info->chip)
-			domain->name = info->chip->name;
+	if (domain)
 		irq_domain_update_bus_token(domain, info->bus_token);
-	}
 
 	return domain;
 }
@@ -1112,14 +1109,35 @@ int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev,
 	return 0;
 
 fail:
-	for (--virq; virq >= virq_base; virq--)
+	for (--virq; virq >= virq_base; virq--) {
+		msi_domain_depopulate_descs(dev, virq, 1);
 		irq_domain_free_irqs_common(domain, virq, 1);
+	}
 	msi_domain_free_descs(dev, &ctrl);
 unlock:
 	msi_unlock_descs(dev);
 	return ret;
 }
 
+void msi_domain_depopulate_descs(struct device *dev, int virq_base, int nvec)
+{
+	struct msi_ctrl ctrl = {
+		.domid	= MSI_DEFAULT_DOMAIN,
+		.first  = virq_base,
+		.last	= virq_base + nvec - 1,
+	};
+	struct msi_desc *desc;
+	struct xarray *xa;
+	unsigned long idx;
+
+	if (!msi_ctrl_valid(dev, &ctrl))
+		return;
+
+	xa = &dev->msi.data->__domains[ctrl.domid].store;
+	xa_for_each_range(xa, idx, desc, ctrl.first, ctrl.last)
+		desc->irq = 0;
+}
+
 /*
  * Carefully check whether the device can use reservation mode. If
  * reservation mode is enabled then the early activation will assign a
diff --git a/drivers/pci/msi/api.c b/drivers/pci/msi/api.c
index b8009aa11f3c..be679aa5db64 100644
--- a/drivers/pci/msi/api.c
+++ b/drivers/pci/msi/api.c
@@ -163,11 +163,11 @@ EXPORT_SYMBOL_GPL(pci_msix_alloc_irq_at);
 
 /**
  * pci_msix_free_irq - Free an interrupt on a PCI/MSIX interrupt domain
- *		      which was allocated via pci_msix_alloc_irq_at()
  *
  * @dev:	The PCI device to operate on
  * @map:	A struct msi_map describing the interrupt to free
- *		as returned from the allocation function.
+ *
+ * Undo an interrupt vector allocation. Does not disable MSI-X.
  */
 void pci_msix_free_irq(struct pci_dev *dev, struct msi_map map)
 {
diff --git a/kernel/irq/ipi.c b/kernel/irq/ipi.c
index bbd945bacef0..961d4af76af3 100644
--- a/kernel/irq/ipi.c
+++ b/kernel/irq/ipi.c
@@ -188,9 +188,9 @@ EXPORT_SYMBOL_GPL(ipi_get_hwirq);
 static int ipi_send_verify(struct irq_chip *chip, struct irq_data *data,
 			   const struct cpumask *dest, unsigned int cpu)
 {
-	const struct cpumask *ipimask = irq_data_get_affinity_mask(data);
+	const struct cpumask *ipimask;
 
-	if (!chip || !ipimask)
+	if (!chip || !data)
 		return -EINVAL;
 
 	if (!chip->ipi_send_single && !chip->ipi_send_mask)
@@ -199,6 +199,10 @@ static int ipi_send_verify(struct irq_chip *chip, struct irq_data *data,
 	if (cpu >= nr_cpu_ids)
 		return -EINVAL;
 
+	ipimask = irq_data_get_affinity_mask(data);
+	if (!ipimask)
+		return -EINVAL;
+
 	if (dest) {
 		if (!cpumask_subset(dest, ipimask))
 			return -EINVAL;
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index fd0996274401..240e145e969f 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -277,7 +277,7 @@ static struct attribute *irq_attrs[] = {
 };
 ATTRIBUTE_GROUPS(irq);
 
-static struct kobj_type irq_kobj_type = {
+static const struct kobj_type irq_kobj_type = {
 	.release	= irq_kobj_release,
 	.sysfs_ops	= &kobj_sysfs_ops,
 	.default_groups = irq_groups,
@@ -335,7 +335,7 @@ postcore_initcall(irq_sysfs_init);
 
 #else /* !CONFIG_SYSFS */
 
-static struct kobj_type irq_kobj_type = {
+static const struct kobj_type irq_kobj_type = {
 	.release	= irq_kobj_release,
 };
 
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
index 783a3e6a0b10..13d96495e6d0 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -1084,10 +1084,13 @@ int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev,
 	struct xarray *xa;
 	int ret, virq;
 
-	if (!msi_ctrl_valid(dev, &ctrl))
-		return -EINVAL;
-
 	msi_lock_descs(dev);
+
+	if (!msi_ctrl_valid(dev, &ctrl)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
 	ret = msi_domain_add_simple_msi_descs(dev, &ctrl);
 	if (ret)
 		goto unlock;

[GIT pull] x86/urgent for v6.3-rc1

[Thomas Gleixner]

Linus,

please pull the latest x86/urgent branch from:

   git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86-urgent-2023-03-05

up to:  dd093fb08e8f: virt/sev-guest: Return -EIO if certificate buffer is not large enough


A small set of updates for x86:

 - Return -EIO instead of success when the certificate buffer for SEV
   guests is not large enough.

 - Allow STIPB to be enabled with legacy IBSR. Legacy IBRS is cleared on
   return to userspace for performance reasons, but the leaves user space
   vulnerable to cross-thread attacks which STIBP prevents. Update the
   documentation accordingly.

Thanks,

	tglx

------------------>
KP Singh (2):
      x86/speculation: Allow enabling STIBP with legacy IBRS
      Documentation/hw-vuln: Document the interaction between IBRS and STIBP

Tom Lendacky (1):
      virt/sev-guest: Return -EIO if certificate buffer is not large enough


 Documentation/admin-guide/hw-vuln/spectre.rst | 21 ++++++++++++++++-----
 arch/x86/kernel/cpu/bugs.c                    | 25 ++++++++++++++++++-------
 drivers/virt/coco/sev-guest/sev-guest.c       | 20 +++++++++++++++++---
 3 files changed, 51 insertions(+), 15 deletions(-)

diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
index 3fe6511c5405..4d186f599d90 100644
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -479,8 +479,16 @@ Spectre variant 2
    On Intel Skylake-era systems the mitigation covers most, but not all,
    cases. See :ref:`[3] <spec_ref3>` for more details.
 
-   On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced
-   IBRS on x86), retpoline is automatically disabled at run time.
+   On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS
+   or enhanced IBRS on x86), retpoline is automatically disabled at run time.
+
+   Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at
+   boot, by setting the IBRS bit, and they're automatically protected against
+   Spectre v2 variant attacks, including cross-thread branch target injections
+   on SMT systems (STIBP). In other words, eIBRS enables STIBP too.
+
+   Legacy IBRS systems clear the IBRS bit on exit to userspace and
+   therefore explicitly enable STIBP for that
 
    The retpoline mitigation is turned on by default on vulnerable
    CPUs. It can be forced on or off by the administrator
@@ -504,9 +512,12 @@ Spectre variant 2
    For Spectre variant 2 mitigation, individual user programs
    can be compiled with return trampolines for indirect branches.
    This protects them from consuming poisoned entries in the branch
-   target buffer left by malicious software.  Alternatively, the
-   programs can disable their indirect branch speculation via prctl()
-   (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
+   target buffer left by malicious software.
+
+   On legacy IBRS systems, at return to userspace, implicit STIBP is disabled
+   because the kernel clears the IBRS bit. In this case, the userspace programs
+   can disable indirect branch speculation via prctl() (See
+   :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
    On x86, this will turn on STIBP to guard against attacks from the
    sibling thread when the user program is running, and use IBPB to
    flush the branch target buffer when switching to/from the program.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index cf81848b72f4..f9d060e71c3e 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1133,14 +1133,18 @@ spectre_v2_parse_user_cmdline(void)
 	return SPECTRE_V2_USER_CMD_AUTO;
 }
 
-static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
+static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode)
 {
-	return mode == SPECTRE_V2_IBRS ||
-	       mode == SPECTRE_V2_EIBRS ||
+	return mode == SPECTRE_V2_EIBRS ||
 	       mode == SPECTRE_V2_EIBRS_RETPOLINE ||
 	       mode == SPECTRE_V2_EIBRS_LFENCE;
 }
 
+static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
+{
+	return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS;
+}
+
 static void __init
 spectre_v2_user_select_mitigation(void)
 {
@@ -1203,12 +1207,19 @@ spectre_v2_user_select_mitigation(void)
 	}
 
 	/*
-	 * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible,
-	 * STIBP is not required.
+	 * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP
+	 * is not required.
+	 *
+	 * Enhanced IBRS also protects against cross-thread branch target
+	 * injection in user-mode as the IBRS bit remains always set which
+	 * implicitly enables cross-thread protections.  However, in legacy IBRS
+	 * mode, the IBRS bit is set only on kernel entry and cleared on return
+	 * to userspace. This disables the implicit cross-thread protection,
+	 * so allow for STIBP to be selected in that case.
 	 */
 	if (!boot_cpu_has(X86_FEATURE_STIBP) ||
 	    !smt_possible ||
-	    spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+	    spectre_v2_in_eibrs_mode(spectre_v2_enabled))
 		return;
 
 	/*
@@ -2340,7 +2351,7 @@ static ssize_t mmio_stale_data_show_state(char *buf)
 
 static char *stibp_state(void)
 {
-	if (spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+	if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
 		return "";
 
 	switch (spectre_v2_user_stibp) {
diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c
index 4ec4174e05a3..7b4e9009f335 100644
--- a/drivers/virt/coco/sev-guest/sev-guest.c
+++ b/drivers/virt/coco/sev-guest/sev-guest.c
@@ -377,9 +377,26 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in
 		snp_dev->input.data_npages = certs_npages;
 	}
 
+	/*
+	 * Increment the message sequence number. There is no harm in doing
+	 * this now because decryption uses the value stored in the response
+	 * structure and any failure will wipe the VMPCK, preventing further
+	 * use anyway.
+	 */
+	snp_inc_msg_seqno(snp_dev);
+
 	if (fw_err)
 		*fw_err = err;
 
+	/*
+	 * If an extended guest request was issued and the supplied certificate
+	 * buffer was not large enough, a standard guest request was issued to
+	 * prevent IV reuse. If the standard request was successful, return -EIO
+	 * back to the caller as would have originally been returned.
+	 */
+	if (!rc && err == SNP_GUEST_REQ_INVALID_LEN)
+		return -EIO;
+
 	if (rc) {
 		dev_alert(snp_dev->dev,
 			  "Detected error from ASP request. rc: %d, fw_err: %llu\n",
@@ -395,9 +412,6 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in
 		goto disable_vmpck;
 	}
 
-	/* Increment to new message sequence after payload decryption was successful. */
-	snp_inc_msg_seqno(snp_dev);
-
 	return 0;
 
 disable_vmpck:

Re: [GIT pull] irq/urgent for v6.3-rc1

[Linus Torvalds]

On Sun, Mar 5, 2023 at 12:55 AM Thomas Gleixner <tglx@linutronix.de> wrote:
>
> ...
>  kernel/irq/msi.c            |   28 +++++++++++++++++++++++-----
>  kernel/irq/msi.c            |    9 ++++++---
>  8 files changed, 44 insertions(+), 15 deletions(-)

Funky diffstat you have there, with the same file done twice. I get
(and would have expected)

 ...
 kernel/irq/msi.c            | 37 +++++++++++++++++++++++++++++--------
 7 files changed, 44 insertions(+), 15 deletions(-)

instead.

           Linus

Re: [GIT pull] x86/urgent for v6.3-rc1

[pr-tracker-bot]

The pull request you sent on Sun,  5 Mar 2023 09:54:58 +0100 (CET):

> git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86-urgent-2023-03-05

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/7f9ec7d8169b5281eff2b907d8ffb1bf56045f73

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

Re: [GIT pull] irq/urgent for v6.3-rc1

[pr-tracker-bot]

The pull request you sent on Sun,  5 Mar 2023 09:54:57 +0100 (CET):

> git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq-urgent-2023-03-05

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/4e9c542c7a51bcc8f6ce283459900ba47a6690f5

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

Re: [GIT pull] irq/urgent for v6.3-rc1

[Thomas Gleixner]

On Sun, Mar 05 2023 at 11:24, Linus Torvalds wrote:
> On Sun, Mar 5, 2023 at 12:55 AM Thomas Gleixner <tglx@linutronix.de> wrote:
>> ...
>>  kernel/irq/msi.c            |   28 +++++++++++++++++++++++-----
>>  kernel/irq/msi.c            |    9 ++++++---
>>  8 files changed, 44 insertions(+), 15 deletions(-)
>
> Funky diffstat you have there, with the same file done twice. I get
> (and would have expected)

Hrm.

>  ...
>  kernel/irq/msi.c            | 37 +++++++++++++++++++++++++++++--------
>  7 files changed, 44 insertions(+), 15 deletions(-)
>
> instead.

That looks more correct. Let me see what my script zoo managed to get
wrong this time.

Thanks,

        tglx

Re: [GIT pull] irq/urgent for v6.3-rc1

[Linus Torvalds]

On Sun, Mar 5, 2023 at 11:47 AM Thomas Gleixner <tglx@linutronix.de> wrote:
>
> That looks more correct. Let me see what my script zoo managed to get
> wrong this time.

I think your scripts did the equivalent of generating the diffs for
all commits separately, and then feeding that to "diffstat".

That _is_ a kind of real diffstat too.

It's just not the one I get when I pull and compare (since I'll be
using the "end result" diff, not the "commits as separate diffs" one).

                Linus

Re: [GIT pull] irq/urgent for v6.3-rc1

[Thomas Gleixner]

On Sun, Mar 05 2023 at 11:50, Linus Torvalds wrote:
> On Sun, Mar 5, 2023 at 11:47 AM Thomas Gleixner <tglx@linutronix.de> wrote:
>>
>> That looks more correct. Let me see what my script zoo managed to get
>> wrong this time.
>
> I think your scripts did the equivalent of generating the diffs for
> all commits separately, and then feeding that to "diffstat".

Kinda. It's the case where the merge in the middle of the commits caused
the thing to create something completely nonsensical. There is even a
comment which says:

 # FIXME: Merge into Linus head and diff there

I put that in after you explained it to me quite some years ago that in
that case 'git merge-base irq/urgent linus' does not work.

Obviously that lazy sod who put the comment there did never bother to
fix it for real. :)

Thanks,

        tglx