* [PATCH 4.9 001/107] ext4: fix check to prevent initializing reserved inodes
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 002/107] tpm: fix race condition in tpm_common_write() Greg Kroah-Hartman
` (104 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Whitney, Theodore Tso
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 5012284700775a4e6e3fbe7eac4c543c4874b559 upstream.
Commit 8844618d8aa7: "ext4: only look at the bg_flags field if it is
valid" will complain if block group zero does not have the
EXT4_BG_INODE_ZEROED flag set. Unfortunately, this is not correct,
since a freshly created file system has this flag cleared. It gets
almost immediately after the file system is mounted read-write --- but
the following somewhat unlikely sequence will end up triggering a
false positive report of a corrupted file system:
mkfs.ext4 /dev/vdc
mount -o ro /dev/vdc /vdc
mount -o remount,rw /dev/vdc
Instead, when initializing the inode table for block group zero, test
to make sure that itable_unused count is not too large, since that is
the case that will result in some or all of the reserved inodes
getting cleared.
This fixes the failures reported by Eric Whiteney when running
generic/230 and generic/231 in the the nojournal test case.
Fixes: 8844618d8aa7 ("ext4: only look at the bg_flags field if it is valid")
Reported-by: Eric Whitney <enwlinux@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/ialloc.c | 5 ++++-
fs/ext4/super.c | 8 +-------
2 files changed, 5 insertions(+), 8 deletions(-)
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -1316,7 +1316,10 @@ int ext4_init_inode_table(struct super_b
ext4_itable_unused_count(sb, gdp)),
sbi->s_inodes_per_block);
- if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group)) {
+ if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) ||
+ ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) -
+ ext4_itable_unused_count(sb, gdp)) <
+ EXT4_FIRST_INO(sb)))) {
ext4_error(sb, "Something is wrong with group %u: "
"used itable blocks: %d; "
"itable unused count: %u",
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3031,14 +3031,8 @@ static ext4_group_t ext4_has_uninit_itab
if (!gdp)
continue;
- if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))
- continue;
- if (group != 0)
+ if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)))
break;
- ext4_error(sb, "Inode table for bg 0 marked as "
- "needing zeroing");
- if (sb->s_flags & MS_RDONLY)
- return ngroups;
}
return group;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 002/107] tpm: fix race condition in tpm_common_write()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 001/107] ext4: fix check to prevent initializing reserved inodes Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 003/107] parisc: Enable CONFIG_MLONGCALLS by default Greg Kroah-Hartman
` (103 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tadeusz Struk, Jarkko Sakkinen
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tadeusz Struk <tadeusz.struk@intel.com>
commit 3ab2011ea368ec3433ad49e1b9e1c7b70d2e65df upstream.
There is a race condition in tpm_common_write function allowing
two threads on the same /dev/tpm<N>, or two different applications
on the same /dev/tpmrm<N> to overwrite each other commands/responses.
Fixed this by taking the priv->buffer_mutex early in the function.
Also converted the priv->data_pending from atomic to a regular size_t
type. There is no need for it to be atomic since it is only touched
under the protection of the priv->buffer_mutex.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm-dev.c | 43 ++++++++++++++++++++-----------------------
1 file changed, 20 insertions(+), 23 deletions(-)
--- a/drivers/char/tpm/tpm-dev.c
+++ b/drivers/char/tpm/tpm-dev.c
@@ -25,7 +25,7 @@ struct file_priv {
struct tpm_chip *chip;
/* Data passed to and from the tpm via the read/write calls */
- atomic_t data_pending;
+ size_t data_pending;
struct mutex buffer_mutex;
struct timer_list user_read_timer; /* user needs to claim result */
@@ -46,7 +46,7 @@ static void timeout_work(struct work_str
struct file_priv *priv = container_of(work, struct file_priv, work);
mutex_lock(&priv->buffer_mutex);
- atomic_set(&priv->data_pending, 0);
+ priv->data_pending = 0;
memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
mutex_unlock(&priv->buffer_mutex);
}
@@ -72,7 +72,6 @@ static int tpm_open(struct inode *inode,
}
priv->chip = chip;
- atomic_set(&priv->data_pending, 0);
mutex_init(&priv->buffer_mutex);
setup_timer(&priv->user_read_timer, user_reader_timeout,
(unsigned long)priv);
@@ -86,28 +85,24 @@ static ssize_t tpm_read(struct file *fil
size_t size, loff_t *off)
{
struct file_priv *priv = file->private_data;
- ssize_t ret_size;
+ ssize_t ret_size = 0;
int rc;
del_singleshot_timer_sync(&priv->user_read_timer);
flush_work(&priv->work);
- ret_size = atomic_read(&priv->data_pending);
- if (ret_size > 0) { /* relay data */
- ssize_t orig_ret_size = ret_size;
- if (size < ret_size)
- ret_size = size;
+ mutex_lock(&priv->buffer_mutex);
- mutex_lock(&priv->buffer_mutex);
+ if (priv->data_pending) {
+ ret_size = min_t(ssize_t, size, priv->data_pending);
rc = copy_to_user(buf, priv->data_buffer, ret_size);
- memset(priv->data_buffer, 0, orig_ret_size);
+ memset(priv->data_buffer, 0, priv->data_pending);
if (rc)
ret_size = -EFAULT;
- mutex_unlock(&priv->buffer_mutex);
+ priv->data_pending = 0;
}
- atomic_set(&priv->data_pending, 0);
-
+ mutex_unlock(&priv->buffer_mutex);
return ret_size;
}
@@ -118,18 +113,20 @@ static ssize_t tpm_write(struct file *fi
size_t in_size = size;
ssize_t out_size;
- /* cannot perform a write until the read has cleared
- either via tpm_read or a user_read_timer timeout.
- This also prevents splitted buffered writes from blocking here.
- */
- if (atomic_read(&priv->data_pending) != 0)
- return -EBUSY;
-
if (in_size > TPM_BUFSIZE)
return -E2BIG;
mutex_lock(&priv->buffer_mutex);
+ /* Cannot perform a write until the read has cleared either via
+ * tpm_read or a user_read_timer timeout. This also prevents split
+ * buffered writes from blocking here.
+ */
+ if (priv->data_pending != 0) {
+ mutex_unlock(&priv->buffer_mutex);
+ return -EBUSY;
+ }
+
if (copy_from_user
(priv->data_buffer, (void __user *) buf, in_size)) {
mutex_unlock(&priv->buffer_mutex);
@@ -159,7 +156,7 @@ static ssize_t tpm_write(struct file *fi
return out_size;
}
- atomic_set(&priv->data_pending, out_size);
+ priv->data_pending = out_size;
mutex_unlock(&priv->buffer_mutex);
/* Set a timeout by which the reader must come claim the result */
@@ -178,7 +175,7 @@ static int tpm_release(struct inode *ino
del_singleshot_timer_sync(&priv->user_read_timer);
flush_work(&priv->work);
file->private_data = NULL;
- atomic_set(&priv->data_pending, 0);
+ priv->data_pending = 0;
clear_bit(0, &priv->chip->is_open);
kfree(priv);
return 0;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 003/107] parisc: Enable CONFIG_MLONGCALLS by default
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 001/107] ext4: fix check to prevent initializing reserved inodes Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 002/107] tpm: fix race condition in tpm_common_write() Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 005/107] kasan: add no_sanitize attribute for clang builds Greg Kroah-Hartman
` (102 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Helge Deller
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 66509a276c8c1d19ee3f661a41b418d101c57d29 upstream.
Enable the -mlong-calls compiler option by default, because otherwise in most
cases linking the vmlinux binary fails due to truncations of R_PARISC_PCREL22F
relocations. This fixes building the 64-bit defconfig.
Cc: stable@vger.kernel.org # 4.0+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -184,7 +184,7 @@ config PREFETCH
config MLONGCALLS
bool "Enable the -mlong-calls compiler option for big kernels"
- def_bool y if (!MODULES)
+ default y
depends on PA8X00
help
If you configure the kernel to include many drivers built-in instead
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 005/107] kasan: add no_sanitize attribute for clang builds
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 003/107] parisc: Enable CONFIG_MLONGCALLS by default Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 006/107] Mark HI and TASKLET softirq synchronous Greg Kroah-Hartman
` (101 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Konovalov, Andrey Ryabinin,
Alexander Potapenko, Dmitry Vyukov, David Rientjes,
Thomas Gleixner, Ingo Molnar, David Woodhouse, Will Deacon,
Paul Lawrence, Sandipan Das, Kees Cook, Andrew Morton,
Linus Torvalds, Sodagudi Prasad
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Konovalov <andreyknvl@google.com>
commit 12c8f25a016dff69ee284aa3338bebfd2cfcba33 upstream.
KASAN uses the __no_sanitize_address macro to disable instrumentation of
particular functions. Right now it's defined only for GCC build, which
causes false positives when clang is used.
This patch adds a definition for clang.
Note, that clang's revision 329612 or higher is required.
[andreyknvl@google.com: remove redundant #ifdef CONFIG_KASAN check]
Link: http://lkml.kernel.org/r/c79aa31a2a2790f6131ed607c58b0dd45dd62a6c.1523967959.git.andreyknvl@google.com
Link: http://lkml.kernel.org/r/4ad725cc903f8534f8c8a60f0daade5e3d674f8d.1523554166.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Paul Lawrence <paullawrence@google.com>
Cc: Sandipan Das <sandipan@linux.vnet.ibm.com>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Sodagudi Prasad <psodagud@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/compiler-clang.h | 3 +++
1 file changed, 3 insertions(+)
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -16,6 +16,9 @@
*/
#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
+#undef __no_sanitize_address
+#define __no_sanitize_address __attribute__((no_sanitize("address")))
+
/* Clang doesn't have a way to turn it off per-function, yet. */
#ifdef __noretpoline
#undef __noretpoline
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 006/107] Mark HI and TASKLET softirq synchronous
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 005/107] kasan: add no_sanitize attribute for clang builds Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 007/107] xen/netfront: dont cache skb_shinfo() Greg Kroah-Hartman
` (100 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab, Alan Stern,
Eric Dumazet, Ingo Molnar, Linus Torvalds
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 3c53776e29f81719efcf8f7a6e30cdf753bee94d upstream.
Way back in 4.9, we committed 4cd13c21b207 ("softirq: Let ksoftirqd do
its job"), and ever since we've had small nagging issues with it. For
example, we've had:
1ff688209e2e ("watchdog: core: make sure the watchdog_worker is not deferred")
8d5755b3f77b ("watchdog: softdog: fire watchdog even if softirqs do not get to run")
217f69743681 ("net: busy-poll: allow preemption in sk_busy_loop()")
all of which worked around some of the effects of that commit.
The DVB people have also complained that the commit causes excessive USB
URB latencies, which seems to be due to the USB code using tasklets to
schedule USB traffic. This seems to be an issue mainly when already
living on the edge, but waiting for ksoftirqd to handle it really does
seem to cause excessive latencies.
Now Hanna Hawa reports that this issue isn't just limited to USB URB and
DVB, but also causes timeout problems for the Marvell SoC team:
"I'm facing kernel panic issue while running raid 5 on sata disks
connected to Macchiatobin (Marvell community board with Armada-8040
SoC with 4 ARMv8 cores of CA72) Raid 5 built with Marvell DMA engine
and async_tx mechanism (ASYNC_TX_DMA [=y]); the DMA driver (mv_xor_v2)
uses a tasklet to clean the done descriptors from the queue"
The latency problem causes a panic:
mv_xor_v2 f0400000.xor: dma_sync_wait: timeout!
Kernel panic - not syncing: async_tx_quiesce: DMA error waiting for transaction
We've discussed simply just reverting the original commit entirely, and
also much more involved solutions (with per-softirq threads etc). This
patch is intentionally stupid and fairly limited, because the issue
still remains, and the other solutions either got sidetracked or had
other issues.
We should probably also consider the timer softirqs to be synchronous
and not be delayed to ksoftirqd (since they were the issue with the
earlier watchdog problems), but that should be done as a separate patch.
This does only the tasklet cases.
Reported-and-tested-by: Hanna Hawa <hannah@marvell.com>
Reported-and-tested-by: Josef Griebichler <griebichler.josef@gmx.at>
Reported-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/softirq.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -79,12 +79,16 @@ static void wakeup_softirqd(void)
/*
* If ksoftirqd is scheduled, we do not want to process pending softirqs
- * right now. Let ksoftirqd handle this at its own rate, to get fairness.
+ * right now. Let ksoftirqd handle this at its own rate, to get fairness,
+ * unless we're doing some of the synchronous softirqs.
*/
-static bool ksoftirqd_running(void)
+#define SOFTIRQ_NOW_MASK ((1 << HI_SOFTIRQ) | (1 << TASKLET_SOFTIRQ))
+static bool ksoftirqd_running(unsigned long pending)
{
struct task_struct *tsk = __this_cpu_read(ksoftirqd);
+ if (pending & SOFTIRQ_NOW_MASK)
+ return false;
return tsk && (tsk->state == TASK_RUNNING);
}
@@ -324,7 +328,7 @@ asmlinkage __visible void do_softirq(voi
pending = local_softirq_pending();
- if (pending && !ksoftirqd_running())
+ if (pending && !ksoftirqd_running(pending))
do_softirq_own_stack();
local_irq_restore(flags);
@@ -351,7 +355,7 @@ void irq_enter(void)
static inline void invoke_softirq(void)
{
- if (ksoftirqd_running())
+ if (ksoftirqd_running(local_softirq_pending()))
return;
if (!force_irqthreads) {
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 007/107] xen/netfront: dont cache skb_shinfo()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 006/107] Mark HI and TASKLET softirq synchronous Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 008/107] ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices Greg Kroah-Hartman
` (99 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Juergen Gross, Wei Liu, David S. Miller
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
commit d472b3a6cf63cd31cae1ed61930f07e6cd6671b5 upstream.
skb_shinfo() can change when calling __pskb_pull_tail(): Don't cache
its return value.
Cc: stable@vger.kernel.org
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/xen-netfront.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -893,7 +893,6 @@ static RING_IDX xennet_fill_frags(struct
struct sk_buff *skb,
struct sk_buff_head *list)
{
- struct skb_shared_info *shinfo = skb_shinfo(skb);
RING_IDX cons = queue->rx.rsp_cons;
struct sk_buff *nskb;
@@ -902,15 +901,16 @@ static RING_IDX xennet_fill_frags(struct
RING_GET_RESPONSE(&queue->rx, ++cons);
skb_frag_t *nfrag = &skb_shinfo(nskb)->frags[0];
- if (shinfo->nr_frags == MAX_SKB_FRAGS) {
+ if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) {
unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
BUG_ON(pull_to <= skb_headlen(skb));
__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
}
- BUG_ON(shinfo->nr_frags >= MAX_SKB_FRAGS);
+ BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
- skb_add_rx_frag(skb, shinfo->nr_frags, skb_frag_page(nfrag),
+ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ skb_frag_page(nfrag),
rx->offset, rx->status, PAGE_SIZE);
skb_shinfo(nskb)->nr_frags = 0;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 008/107] ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 007/107] xen/netfront: dont cache skb_shinfo() Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 009/107] scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled Greg Kroah-Hartman
` (98 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Rafael J . Wysocki,
Thierry Reding, Sudip Mukherjee
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit fdcb613d49321b5bf5d5a1bd0fba8e7c241dcc70 upstream.
The LPSS PWM device on on Bay Trail and Cherry Trail devices has a set
of private registers at offset 0x800, the current lpss_device_desc for
them already sets the LPSS_SAVE_CTX flag to have these saved/restored
over device-suspend, but the current lpss_device_desc was not setting
the prv_offset field, leading to the regular device registers getting
saved/restored instead.
This is causing the PWM controller to no longer work, resulting in a black
screen, after a suspend/resume on systems where the firmware clears the
APB clock and reset bits at offset 0x804.
This commit fixes this by properly setting prv_offset to 0x800 for
the PWM devices.
Cc: stable@vger.kernel.org
Fixes: e1c748179754 ("ACPI / LPSS: Add Intel BayTrail ACPI mode PWM")
Fixes: 1bfbd8eb8a7f ("ACPI / LPSS: Add ACPI IDs for Intel Braswell")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Rafael J . Wysocki <rjw@rjwysocki.net>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpi_lpss.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -187,10 +187,12 @@ static const struct lpss_device_desc lpt
static const struct lpss_device_desc byt_pwm_dev_desc = {
.flags = LPSS_SAVE_CTX,
+ .prv_offset = 0x800,
};
static const struct lpss_device_desc bsw_pwm_dev_desc = {
.flags = LPSS_SAVE_CTX | LPSS_NO_D3_DELAY,
+ .prv_offset = 0x800,
};
static const struct lpss_device_desc byt_uart_dev_desc = {
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 009/107] scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 008/107] ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 010/107] init: rename and re-order boot_cpu_state_init() Greg Kroah-Hartman
` (97 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Maurizio Lombardi,
Johannes Thumshirn, Alan Stern, Martin K. Petersen
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@wdc.com>
commit 1214fd7b497400d200e3f4e64e2338b303a20949 upstream.
Surround scsi_execute() calls with scsi_autopm_get_device() and
scsi_autopm_put_device(). Note: removing sr_mutex protection from the
scsi_cd_get() and scsi_cd_put() calls is safe because the purpose of
sr_mutex is to serialize cdrom_*() calls.
This patch avoids that complaints similar to the following appear in the
kernel log if runtime power management is enabled:
INFO: task systemd-udevd:650 blocked for more than 120 seconds.
Not tainted 4.18.0-rc7-dbg+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
systemd-udevd D28176 650 513 0x00000104
Call Trace:
__schedule+0x444/0xfe0
schedule+0x4e/0xe0
schedule_preempt_disabled+0x18/0x30
__mutex_lock+0x41c/0xc70
mutex_lock_nested+0x1b/0x20
__blkdev_get+0x106/0x970
blkdev_get+0x22c/0x5a0
blkdev_open+0xe9/0x100
do_dentry_open.isra.19+0x33e/0x570
vfs_open+0x7c/0xd0
path_openat+0x6e3/0x1120
do_filp_open+0x11c/0x1c0
do_sys_open+0x208/0x2d0
__x64_sys_openat+0x59/0x70
do_syscall_64+0x77/0x230
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Cc: Maurizio Lombardi <mlombard@redhat.com>
Cc: Johannes Thumshirn <jthumshirn@suse.de>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: <stable@vger.kernel.org>
Tested-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sr.c | 29 +++++++++++++++++++++--------
1 file changed, 21 insertions(+), 8 deletions(-)
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -520,18 +520,26 @@ static int sr_init_command(struct scsi_c
static int sr_block_open(struct block_device *bdev, fmode_t mode)
{
struct scsi_cd *cd;
+ struct scsi_device *sdev;
int ret = -ENXIO;
+ cd = scsi_cd_get(bdev->bd_disk);
+ if (!cd)
+ goto out;
+
+ sdev = cd->device;
+ scsi_autopm_get_device(sdev);
check_disk_change(bdev);
mutex_lock(&sr_mutex);
- cd = scsi_cd_get(bdev->bd_disk);
- if (cd) {
- ret = cdrom_open(&cd->cdi, bdev, mode);
- if (ret)
- scsi_cd_put(cd);
- }
+ ret = cdrom_open(&cd->cdi, bdev, mode);
mutex_unlock(&sr_mutex);
+
+ scsi_autopm_put_device(sdev);
+ if (ret)
+ scsi_cd_put(cd);
+
+out:
return ret;
}
@@ -559,6 +567,8 @@ static int sr_block_ioctl(struct block_d
if (ret)
goto out;
+ scsi_autopm_get_device(sdev);
+
/*
* Send SCSI addressing ioctls directly to mid level, send other
* ioctls to cdrom/block level.
@@ -567,15 +577,18 @@ static int sr_block_ioctl(struct block_d
case SCSI_IOCTL_GET_IDLUN:
case SCSI_IOCTL_GET_BUS_NUMBER:
ret = scsi_ioctl(sdev, cmd, argp);
- goto out;
+ goto put;
}
ret = cdrom_ioctl(&cd->cdi, bdev, mode, cmd, arg);
if (ret != -ENOSYS)
- goto out;
+ goto put;
ret = scsi_ioctl(sdev, cmd, argp);
+put:
+ scsi_autopm_put_device(sdev);
+
out:
mutex_unlock(&sr_mutex);
return ret;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 010/107] init: rename and re-order boot_cpu_state_init()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 009/107] scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 011/107] root dentries need RCU-delayed freeing Greg Kroah-Hartman
` (96 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vlastimil Babka, Mian Yousaf Kaukab,
Catalin Marinas, Thomas Gleixner, Will Deacon, stable,
Linus Torvalds
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit b5b1404d0815894de0690de8a1ab58269e56eae6 upstream.
This is purely a preparatory patch for upcoming changes during the 4.19
merge window.
We have a function called "boot_cpu_state_init()" that isn't really
about the bootup cpu state: that is done much earlier by the similarly
named "boot_cpu_init()" (note lack of "state" in name).
This function initializes some hotplug CPU state, and needs to run after
the percpu data has been properly initialized. It even has a comment to
that effect.
Except it _doesn't_ actually run after the percpu data has been properly
initialized. On x86 it happens to do that, but on at least arm and
arm64, the percpu base pointers are initialized by the arch-specific
'smp_prepare_boot_cpu()' hook, which ran _after_ boot_cpu_state_init().
This had some unexpected results, and in particular we have a patch
pending for the merge window that did the obvious cleanup of using
'this_cpu_write()' in the cpu hotplug init code:
- per_cpu_ptr(&cpuhp_state, smp_processor_id())->state = CPUHP_ONLINE;
+ this_cpu_write(cpuhp_state.state, CPUHP_ONLINE);
which is obviously the right thing to do. Except because of the
ordering issue, it actually failed miserably and unexpectedly on arm64.
So this just fixes the ordering, and changes the name of the function to
be 'boot_cpu_hotplug_init()' to make it obvious that it's about cpu
hotplug state, because the core CPU state was supposed to have already
been done earlier.
Marked for stable, since the (not yet merged) patch that will show this
problem is marked for stable.
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Reported-by: Mian Yousaf Kaukab <yousaf.kaukab@suse.com>
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/cpu.h | 2 +-
init/main.c | 2 +-
kernel/cpu.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -29,7 +29,7 @@ struct cpu {
};
extern void boot_cpu_init(void);
-extern void boot_cpu_state_init(void);
+extern void boot_cpu_hotplug_init(void);
extern int register_cpu(struct cpu *cpu, int num);
extern struct device *get_cpu_device(unsigned cpu);
--- a/init/main.c
+++ b/init/main.c
@@ -509,8 +509,8 @@ asmlinkage __visible void __init start_k
setup_command_line(command_line);
setup_nr_cpu_ids();
setup_per_cpu_areas();
- boot_cpu_state_init();
smp_prepare_boot_cpu(); /* arch-specific boot-cpu hooks */
+ boot_cpu_hotplug_init();
build_all_zonelists(NULL, NULL);
page_alloc_init();
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1944,7 +1944,7 @@ void __init boot_cpu_init(void)
/*
* Must be called _AFTER_ setting up the per_cpu areas
*/
-void __init boot_cpu_state_init(void)
+void __init boot_cpu_hotplug_init(void)
{
per_cpu_ptr(&cpuhp_state, smp_processor_id())->state = CPUHP_ONLINE;
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 011/107] root dentries need RCU-delayed freeing
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 010/107] init: rename and re-order boot_cpu_state_init() Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 012/107] make sure that __dentry_kill() always invalidates d_seq, unhashed or not Greg Kroah-Hartman
` (95 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 90bad5e05bcdb0308cfa3d3a60f5c0b9c8e2efb3 upstream.
Since mountpoint crossing can happen without leaving lazy mode,
root dentries do need the same protection against having their
memory freed without RCU delay as everything else in the tree.
It's partially hidden by RCU delay between detaching from the
mount tree and dropping the vfsmount reference, but the starting
point of pathwalk can be on an already detached mount, in which
case umount-caused RCU delay has already passed by the time the
lazy pathwalk grabs rcu_read_lock(). If the starting point
happens to be at the root of that vfsmount *and* that vfsmount
covers the entire filesystem, we get trouble.
Fixes: 48a066e72d97 ("RCU'd vsfmounts")
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dcache.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1914,10 +1914,12 @@ struct dentry *d_make_root(struct inode
if (root_inode) {
res = __d_alloc(root_inode->i_sb, NULL);
- if (res)
+ if (res) {
+ res->d_flags |= DCACHE_RCUACCESS;
d_instantiate(res, root_inode);
- else
+ } else {
iput(root_inode);
+ }
}
return res;
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 012/107] make sure that __dentry_kill() always invalidates d_seq, unhashed or not
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 011/107] root dentries need RCU-delayed freeing Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 013/107] fix mntput/mntput race Greg Kroah-Hartman
` (94 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dae R. Jeong, Al Viro
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 4c0d7cd5c8416b1ef41534d19163cb07ffaa03ab upstream.
RCU pathwalk relies upon the assumption that anything that changes
->d_inode of a dentry will invalidate its ->d_seq. That's almost
true - the one exception is that the final dput() of already unhashed
dentry does *not* touch ->d_seq at all. Unhashing does, though,
so for anything we'd found by RCU dcache lookup we are fine.
Unfortunately, we can *start* with an unhashed dentry or jump into
it.
We could try and be careful in the (few) places where that could
happen. Or we could just make the final dput() invalidate the damn
thing, unhashed or not. The latter is much simpler and easier to
backport, so let's do it that way.
Reported-by: "Dae R. Jeong" <threeearcat@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dcache.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -352,14 +352,11 @@ static void dentry_unlink_inode(struct d
__releases(dentry->d_inode->i_lock)
{
struct inode *inode = dentry->d_inode;
- bool hashed = !d_unhashed(dentry);
- if (hashed)
- raw_write_seqcount_begin(&dentry->d_seq);
+ raw_write_seqcount_begin(&dentry->d_seq);
__d_clear_type_and_inode(dentry);
hlist_del_init(&dentry->d_u.d_alias);
- if (hashed)
- raw_write_seqcount_end(&dentry->d_seq);
+ raw_write_seqcount_end(&dentry->d_seq);
spin_unlock(&dentry->d_lock);
spin_unlock(&inode->i_lock);
if (!inode->i_nlink)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 013/107] fix mntput/mntput race
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 012/107] make sure that __dentry_kill() always invalidates d_seq, unhashed or not Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 014/107] fix __legitimize_mnt()/mntput() race Greg Kroah-Hartman
` (93 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jann Horn, Al Viro
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 9ea0a46ca2c318fcc449c1e6b62a7230a17888f1 upstream.
mntput_no_expire() does the calculation of total refcount under mount_lock;
unfortunately, the decrement (as well as all increments) are done outside
of it, leading to false positives in the "are we dropping the last reference"
test. Consider the following situation:
* mnt is a lazy-umounted mount, kept alive by two opened files. One
of those files gets closed. Total refcount of mnt is 2. On CPU 42
mntput(mnt) (called from __fput()) drops one reference, decrementing component
* After it has looked at component #0, the process on CPU 0 does
mntget(), incrementing component #0, gets preempted and gets to run again -
on CPU 69. There it does mntput(), which drops the reference (component #69)
and proceeds to spin on mount_lock.
* On CPU 42 our first mntput() finishes counting. It observes the
decrement of component #69, but not the increment of component #0. As the
result, the total it gets is not 1 as it should've been - it's 0. At which
point we decide that vfsmount needs to be killed and proceed to free it and
shut the filesystem down. However, there's still another opened file
on that filesystem, with reference to (now freed) vfsmount, etc. and we are
screwed.
It's not a wide race, but it can be reproduced with artificial slowdown of
the mnt_get_count() loop, and it should be easier to hit on SMP KVM setups.
Fix consists of moving the refcount decrement under mount_lock; the tricky
part is that we want (and can) keep the fast case (i.e. mount that still
has non-NULL ->mnt_ns) entirely out of mount_lock. All places that zero
mnt->mnt_ns are dropping some reference to mnt and they call synchronize_rcu()
before that mntput(). IOW, if mntput() observes (under rcu_read_lock())
a non-NULL ->mnt_ns, it is guaranteed that there is another reference yet to
be dropped.
Reported-by: Jann Horn <jannh@google.com>
Tested-by: Jann Horn <jannh@google.com>
Fixes: 48a066e72d97 ("RCU'd vsfmounts")
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1139,12 +1139,22 @@ static DECLARE_DELAYED_WORK(delayed_mntp
static void mntput_no_expire(struct mount *mnt)
{
rcu_read_lock();
- mnt_add_count(mnt, -1);
- if (likely(mnt->mnt_ns)) { /* shouldn't be the last one */
+ if (likely(READ_ONCE(mnt->mnt_ns))) {
+ /*
+ * Since we don't do lock_mount_hash() here,
+ * ->mnt_ns can change under us. However, if it's
+ * non-NULL, then there's a reference that won't
+ * be dropped until after an RCU delay done after
+ * turning ->mnt_ns NULL. So if we observe it
+ * non-NULL under rcu_read_lock(), the reference
+ * we are dropping is not the final one.
+ */
+ mnt_add_count(mnt, -1);
rcu_read_unlock();
return;
}
lock_mount_hash();
+ mnt_add_count(mnt, -1);
if (mnt_get_count(mnt)) {
rcu_read_unlock();
unlock_mount_hash();
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 014/107] fix __legitimize_mnt()/mntput() race
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 013/107] fix mntput/mntput race Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 015/107] proc/sysctl: prune stale dentries during unregistering Greg Kroah-Hartman
` (92 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Al Viro
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 119e1ef80ecfe0d1deb6378d4ab41f5b71519de1 upstream.
__legitimize_mnt() has two problems - one is that in case of success
the check of mount_lock is not ordered wrt preceding increment of
refcount, making it possible to have successful __legitimize_mnt()
on one CPU just before the otherwise final mntpu() on another,
with __legitimize_mnt() not seeing mntput() taking the lock and
mntput() not seeing the increment done by __legitimize_mnt().
Solved by a pair of barriers.
Another is that failure of __legitimize_mnt() on the second
read_seqretry() leaves us with reference that'll need to be
dropped by caller; however, if that races with final mntput()
we can end up with caller dropping rcu_read_lock() and doing
mntput() to release that reference - with the first mntput()
having freed the damn thing just as rcu_read_lock() had been
dropped. Solution: in "do mntput() yourself" failure case
grab mount_lock, check if MNT_DOOMED has been set by racing
final mntput() that has missed our increment and if it has -
undo the increment and treat that as "failure, caller doesn't
need to drop anything" case.
It's not easy to hit - the final mntput() has to come right
after the first read_seqretry() in __legitimize_mnt() *and*
manage to miss the increment done by __legitimize_mnt() before
the second read_seqretry() in there. The things that are almost
impossible to hit on bare hardware are not impossible on SMP
KVM, though...
Reported-by: Oleg Nesterov <oleg@redhat.com>
Fixes: 48a066e72d97 ("RCU'd vsfmounts")
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -603,12 +603,21 @@ int __legitimize_mnt(struct vfsmount *ba
return 0;
mnt = real_mount(bastard);
mnt_add_count(mnt, 1);
+ smp_mb(); // see mntput_no_expire()
if (likely(!read_seqretry(&mount_lock, seq)))
return 0;
if (bastard->mnt_flags & MNT_SYNC_UMOUNT) {
mnt_add_count(mnt, -1);
return 1;
}
+ lock_mount_hash();
+ if (unlikely(bastard->mnt_flags & MNT_DOOMED)) {
+ mnt_add_count(mnt, -1);
+ unlock_mount_hash();
+ return 1;
+ }
+ unlock_mount_hash();
+ /* caller will mntput() */
return -1;
}
@@ -1154,6 +1163,11 @@ static void mntput_no_expire(struct moun
return;
}
lock_mount_hash();
+ /*
+ * make sure that if __legitimize_mnt() has not seen us grab
+ * mount_lock, we'll see their refcount increment here.
+ */
+ smp_mb();
mnt_add_count(mnt, -1);
if (mnt_get_count(mnt)) {
rcu_read_unlock();
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 015/107] proc/sysctl: prune stale dentries during unregistering
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 014/107] fix __legitimize_mnt()/mntput() race Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 016/107] proc/sysctl: Dont grab i_lock under sysctl_lock Greg Kroah-Hartman
` (91 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konstantin Khlebnikov, Al Viro,
Eric W. Biederman
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
commit d6cffbbe9a7e51eb705182965a189457c17ba8a3 upstream.
Currently unregistering sysctl table does not prune its dentries.
Stale dentries could slowdown sysctl operations significantly.
For example, command:
# for i in {1..100000} ; do unshare -n -- sysctl -a &> /dev/null ; done
creates a millions of stale denties around sysctls of loopback interface:
# sysctl fs.dentry-state
fs.dentry-state = 25812579 24724135 45 0 0 0
All of them have matching names thus lookup have to scan though whole
hash chain and call d_compare (proc_sys_compare) which checks them
under system-wide spinlock (sysctl_lock).
# time sysctl -a > /dev/null
real 1m12.806s
user 0m0.016s
sys 1m12.400s
Currently only memory reclaimer could remove this garbage.
But without significant memory pressure this never happens.
This patch collects sysctl inodes into list on sysctl table header and
prunes all their dentries once that table unregisters.
Konstantin Khlebnikov <khlebnikov@yandex-team.ru> writes:
> On 10.02.2017 10:47, Al Viro wrote:
>> how about >> the matching stats *after* that patch?
>
> dcache size doesn't grow endlessly, so stats are fine
>
> # sysctl fs.dentry-state
> fs.dentry-state = 92712 58376 45 0 0 0
>
> # time sysctl -a &>/dev/null
>
> real 0m0.013s
> user 0m0.004s
> sys 0m0.008s
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/inode.c | 3 +-
fs/proc/internal.h | 7 ++++-
fs/proc/proc_sysctl.c | 59 +++++++++++++++++++++++++++++++++++--------------
include/linux/sysctl.h | 1
4 files changed, 51 insertions(+), 19 deletions(-)
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -43,10 +43,11 @@ static void proc_evict_inode(struct inod
de = PDE(inode);
if (de)
pde_put(de);
+
head = PROC_I(inode)->sysctl;
if (head) {
RCU_INIT_POINTER(PROC_I(inode)->sysctl, NULL);
- sysctl_head_put(head);
+ proc_sys_evict_inode(inode, head);
}
}
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -65,6 +65,7 @@ struct proc_inode {
struct proc_dir_entry *pde;
struct ctl_table_header *sysctl;
struct ctl_table *sysctl_entry;
+ struct list_head sysctl_inodes;
const struct proc_ns_operations *ns_ops;
struct inode vfs_inode;
};
@@ -249,10 +250,12 @@ extern void proc_thread_self_init(void);
*/
#ifdef CONFIG_PROC_SYSCTL
extern int proc_sys_init(void);
-extern void sysctl_head_put(struct ctl_table_header *);
+extern void proc_sys_evict_inode(struct inode *inode,
+ struct ctl_table_header *head);
#else
static inline void proc_sys_init(void) { }
-static inline void sysctl_head_put(struct ctl_table_header *head) { }
+static inline void proc_sys_evict_inode(struct inode *inode,
+ struct ctl_table_header *head) { }
#endif
/*
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -190,6 +190,7 @@ static void init_header(struct ctl_table
head->set = set;
head->parent = NULL;
head->node = node;
+ INIT_LIST_HEAD(&head->inodes);
if (node) {
struct ctl_table *entry;
for (entry = table; entry->procname; entry++, node++)
@@ -259,6 +260,29 @@ static void unuse_table(struct ctl_table
complete(p->unregistering);
}
+/* called under sysctl_lock */
+static void proc_sys_prune_dcache(struct ctl_table_header *head)
+{
+ struct inode *inode, *prev = NULL;
+ struct proc_inode *ei;
+
+ list_for_each_entry(ei, &head->inodes, sysctl_inodes) {
+ inode = igrab(&ei->vfs_inode);
+ if (inode) {
+ spin_unlock(&sysctl_lock);
+ iput(prev);
+ prev = inode;
+ d_prune_aliases(inode);
+ spin_lock(&sysctl_lock);
+ }
+ }
+ if (prev) {
+ spin_unlock(&sysctl_lock);
+ iput(prev);
+ spin_lock(&sysctl_lock);
+ }
+}
+
/* called under sysctl_lock, will reacquire if has to wait */
static void start_unregistering(struct ctl_table_header *p)
{
@@ -278,27 +302,17 @@ static void start_unregistering(struct c
p->unregistering = ERR_PTR(-EINVAL);
}
/*
+ * Prune dentries for unregistered sysctls: namespaced sysctls
+ * can have duplicate names and contaminate dcache very badly.
+ */
+ proc_sys_prune_dcache(p);
+ /*
* do not remove from the list until nobody holds it; walking the
* list in do_sysctl() relies on that.
*/
erase_header(p);
}
-static void sysctl_head_get(struct ctl_table_header *head)
-{
- spin_lock(&sysctl_lock);
- head->count++;
- spin_unlock(&sysctl_lock);
-}
-
-void sysctl_head_put(struct ctl_table_header *head)
-{
- spin_lock(&sysctl_lock);
- if (!--head->count)
- kfree_rcu(head, rcu);
- spin_unlock(&sysctl_lock);
-}
-
static struct ctl_table_header *sysctl_head_grab(struct ctl_table_header *head)
{
BUG_ON(!head);
@@ -440,11 +454,15 @@ static struct inode *proc_sys_make_inode
inode->i_ino = get_next_ino();
- sysctl_head_get(head);
ei = PROC_I(inode);
ei->sysctl = head;
ei->sysctl_entry = table;
+ spin_lock(&sysctl_lock);
+ list_add(&ei->sysctl_inodes, &head->inodes);
+ head->count++;
+ spin_unlock(&sysctl_lock);
+
inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
inode->i_mode = table->mode;
if (!S_ISDIR(table->mode)) {
@@ -466,6 +484,15 @@ out:
return inode;
}
+void proc_sys_evict_inode(struct inode *inode, struct ctl_table_header *head)
+{
+ spin_lock(&sysctl_lock);
+ list_del(&PROC_I(inode)->sysctl_inodes);
+ if (!--head->count)
+ kfree_rcu(head, rcu);
+ spin_unlock(&sysctl_lock);
+}
+
static struct ctl_table_header *grab_header(struct inode *inode)
{
struct ctl_table_header *head = PROC_I(inode)->sysctl;
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -143,6 +143,7 @@ struct ctl_table_header
struct ctl_table_set *set;
struct ctl_dir *parent;
struct ctl_node *node;
+ struct list_head inodes; /* head for proc_inode->sysctl_inodes */
};
struct ctl_dir {
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 016/107] proc/sysctl: Dont grab i_lock under sysctl_lock.
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 015/107] proc/sysctl: prune stale dentries during unregistering Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 017/107] proc: Fix proc_sys_prune_dcache to hold a sb reference Greg Kroah-Hartman
` (90 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konstantin Khlebnikov, Al Viro,
Eric W. Biederman
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <ebiederm@xmission.com>
commit ace0c791e6c3cf5ef37cad2df69f0d90ccc40ffb upstream.
Konstantin Khlebnikov <khlebnikov@yandex-team.ru> writes:
> This patch has locking problem. I've got lockdep splat under LTP.
>
> [ 6633.115456] ======================================================
> [ 6633.115502] [ INFO: possible circular locking dependency detected ]
> [ 6633.115553] 4.9.10-debug+ #9 Tainted: G L
> [ 6633.115584] -------------------------------------------------------
> [ 6633.115627] ksm02/284980 is trying to acquire lock:
> [ 6633.115659] (&sb->s_type->i_lock_key#4){+.+...}, at: [<ffffffff816bc1ce>] igrab+0x1e/0x80
> [ 6633.115834] but task is already holding lock:
> [ 6633.115882] (sysctl_lock){+.+...}, at: [<ffffffff817e379b>] unregister_sysctl_table+0x6b/0x110
> [ 6633.116026] which lock already depends on the new lock.
> [ 6633.116026]
> [ 6633.116080]
> [ 6633.116080] the existing dependency chain (in reverse order) is:
> [ 6633.116117]
> -> #2 (sysctl_lock){+.+...}:
> -> #1 (&(&dentry->d_lockref.lock)->rlock){+.+...}:
> -> #0 (&sb->s_type->i_lock_key#4){+.+...}:
>
> d_lock nests inside i_lock
> sysctl_lock nests inside d_lock in d_compare
>
> This patch adds i_lock nesting inside sysctl_lock.
Al Viro <viro@ZenIV.linux.org.uk> replied:
> Once ->unregistering is set, you can drop sysctl_lock just fine. So I'd
> try something like this - use rcu_read_lock() in proc_sys_prune_dcache(),
> drop sysctl_lock() before it and regain after. Make sure that no inodes
> are added to the list ones ->unregistering has been set and use RCU list
> primitives for modifying the inode list, with sysctl_lock still used to
> serialize its modifications.
>
> Freeing struct inode is RCU-delayed (see proc_destroy_inode()), so doing
> igrab() is safe there. Since we don't drop inode reference until after we'd
> passed beyond it in the list, list_for_each_entry_rcu() should be fine.
I agree with Al Viro's analsysis of the situtation.
Fixes: d6cffbbe9a7e ("proc/sysctl: prune stale dentries during unregistering")
Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Tested-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Suggested-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/proc_sysctl.c | 31 ++++++++++++++++++-------------
1 file changed, 18 insertions(+), 13 deletions(-)
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -266,21 +266,19 @@ static void proc_sys_prune_dcache(struct
struct inode *inode, *prev = NULL;
struct proc_inode *ei;
- list_for_each_entry(ei, &head->inodes, sysctl_inodes) {
+ rcu_read_lock();
+ list_for_each_entry_rcu(ei, &head->inodes, sysctl_inodes) {
inode = igrab(&ei->vfs_inode);
if (inode) {
- spin_unlock(&sysctl_lock);
+ rcu_read_unlock();
iput(prev);
prev = inode;
d_prune_aliases(inode);
- spin_lock(&sysctl_lock);
+ rcu_read_lock();
}
}
- if (prev) {
- spin_unlock(&sysctl_lock);
- iput(prev);
- spin_lock(&sysctl_lock);
- }
+ rcu_read_unlock();
+ iput(prev);
}
/* called under sysctl_lock, will reacquire if has to wait */
@@ -296,10 +294,10 @@ static void start_unregistering(struct c
p->unregistering = &wait;
spin_unlock(&sysctl_lock);
wait_for_completion(&wait);
- spin_lock(&sysctl_lock);
} else {
/* anything non-NULL; we'll never dereference it */
p->unregistering = ERR_PTR(-EINVAL);
+ spin_unlock(&sysctl_lock);
}
/*
* Prune dentries for unregistered sysctls: namespaced sysctls
@@ -310,6 +308,7 @@ static void start_unregistering(struct c
* do not remove from the list until nobody holds it; walking the
* list in do_sysctl() relies on that.
*/
+ spin_lock(&sysctl_lock);
erase_header(p);
}
@@ -455,11 +454,17 @@ static struct inode *proc_sys_make_inode
inode->i_ino = get_next_ino();
ei = PROC_I(inode);
- ei->sysctl = head;
- ei->sysctl_entry = table;
spin_lock(&sysctl_lock);
- list_add(&ei->sysctl_inodes, &head->inodes);
+ if (unlikely(head->unregistering)) {
+ spin_unlock(&sysctl_lock);
+ iput(inode);
+ inode = NULL;
+ goto out;
+ }
+ ei->sysctl = head;
+ ei->sysctl_entry = table;
+ list_add_rcu(&ei->sysctl_inodes, &head->inodes);
head->count++;
spin_unlock(&sysctl_lock);
@@ -487,7 +492,7 @@ out:
void proc_sys_evict_inode(struct inode *inode, struct ctl_table_header *head)
{
spin_lock(&sysctl_lock);
- list_del(&PROC_I(inode)->sysctl_inodes);
+ list_del_rcu(&PROC_I(inode)->sysctl_inodes);
if (!--head->count)
kfree_rcu(head, rcu);
spin_unlock(&sysctl_lock);
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 017/107] proc: Fix proc_sys_prune_dcache to hold a sb reference
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 016/107] proc/sysctl: Dont grab i_lock under sysctl_lock Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 018/107] IB/core: Make testing MR flags for writability a static inline function Greg Kroah-Hartman
` (89 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrei Vagin, Andrei Vagin,
Eric W. Biederman
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <ebiederm@xmission.com>
commit 2fd1d2c4ceb2248a727696962cf3370dc9f5a0a4 upstream.
Andrei Vagin writes:
FYI: This bug has been reproduced on 4.11.7
> BUG: Dentry ffff895a3dd01240{i=4e7c09a,n=lo} still in use (1) [unmount of proc proc]
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 13588 at fs/dcache.c:1445 umount_check+0x6e/0x80
> CPU: 1 PID: 13588 Comm: kworker/1:1 Not tainted 4.11.7-200.fc25.x86_64 #1
> Hardware name: CompuLab sbc-flt1/fitlet, BIOS SBCFLT_0.08.04 06/27/2015
> Workqueue: events proc_cleanup_work
> Call Trace:
> dump_stack+0x63/0x86
> __warn+0xcb/0xf0
> warn_slowpath_null+0x1d/0x20
> umount_check+0x6e/0x80
> d_walk+0xc6/0x270
> ? dentry_free+0x80/0x80
> do_one_tree+0x26/0x40
> shrink_dcache_for_umount+0x2d/0x90
> generic_shutdown_super+0x1f/0xf0
> kill_anon_super+0x12/0x20
> proc_kill_sb+0x40/0x50
> deactivate_locked_super+0x43/0x70
> deactivate_super+0x5a/0x60
> cleanup_mnt+0x3f/0x90
> mntput_no_expire+0x13b/0x190
> kern_unmount+0x3e/0x50
> pid_ns_release_proc+0x15/0x20
> proc_cleanup_work+0x15/0x20
> process_one_work+0x197/0x450
> worker_thread+0x4e/0x4a0
> kthread+0x109/0x140
> ? process_one_work+0x450/0x450
> ? kthread_park+0x90/0x90
> ret_from_fork+0x2c/0x40
> ---[ end trace e1c109611e5d0b41 ]---
> VFS: Busy inodes after unmount of proc. Self-destruct in 5 seconds. Have a nice day...
> BUG: unable to handle kernel NULL pointer dereference at (null)
> IP: _raw_spin_lock+0xc/0x30
> PGD 0
Fix this by taking a reference to the super block in proc_sys_prune_dcache.
The superblock reference is the core of the fix however the sysctl_inodes
list is converted to a hlist so that hlist_del_init_rcu may be used. This
allows proc_sys_prune_dache to remove inodes the sysctl_inodes list, while
not causing problems for proc_sys_evict_inode when if it later choses to
remove the inode from the sysctl_inodes list. Removing inodes from the
sysctl_inodes list allows proc_sys_prune_dcache to have a progress
guarantee, while still being able to drop all locks. The fact that
head->unregistering is set in start_unregistering ensures that no more
inodes will be added to the the sysctl_inodes list.
Previously the code did a dance where it delayed calling iput until the
next entry in the list was being considered to ensure the inode remained on
the sysctl_inodes list until the next entry was walked to. The structure
of the loop in this patch does not need that so is much easier to
understand and maintain.
Cc: stable@vger.kernel.org
Reported-by: Andrei Vagin <avagin@gmail.com>
Tested-by: Andrei Vagin <avagin@openvz.org>
Fixes: ace0c791e6c3 ("proc/sysctl: Don't grab i_lock under sysctl_lock.")
Fixes: d6cffbbe9a7e ("proc/sysctl: prune stale dentries during unregistering")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/internal.h | 2 +-
fs/proc/proc_sysctl.c | 43 ++++++++++++++++++++++++++++++-------------
include/linux/sysctl.h | 2 +-
3 files changed, 32 insertions(+), 15 deletions(-)
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -65,7 +65,7 @@ struct proc_inode {
struct proc_dir_entry *pde;
struct ctl_table_header *sysctl;
struct ctl_table *sysctl_entry;
- struct list_head sysctl_inodes;
+ struct hlist_node sysctl_inodes;
const struct proc_ns_operations *ns_ops;
struct inode vfs_inode;
};
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -190,7 +190,7 @@ static void init_header(struct ctl_table
head->set = set;
head->parent = NULL;
head->node = node;
- INIT_LIST_HEAD(&head->inodes);
+ INIT_HLIST_HEAD(&head->inodes);
if (node) {
struct ctl_table *entry;
for (entry = table; entry->procname; entry++, node++)
@@ -260,25 +260,42 @@ static void unuse_table(struct ctl_table
complete(p->unregistering);
}
-/* called under sysctl_lock */
static void proc_sys_prune_dcache(struct ctl_table_header *head)
{
- struct inode *inode, *prev = NULL;
+ struct inode *inode;
struct proc_inode *ei;
+ struct hlist_node *node;
+ struct super_block *sb;
rcu_read_lock();
- list_for_each_entry_rcu(ei, &head->inodes, sysctl_inodes) {
- inode = igrab(&ei->vfs_inode);
- if (inode) {
- rcu_read_unlock();
- iput(prev);
- prev = inode;
- d_prune_aliases(inode);
+ for (;;) {
+ node = hlist_first_rcu(&head->inodes);
+ if (!node)
+ break;
+ ei = hlist_entry(node, struct proc_inode, sysctl_inodes);
+ spin_lock(&sysctl_lock);
+ hlist_del_init_rcu(&ei->sysctl_inodes);
+ spin_unlock(&sysctl_lock);
+
+ inode = &ei->vfs_inode;
+ sb = inode->i_sb;
+ if (!atomic_inc_not_zero(&sb->s_active))
+ continue;
+ inode = igrab(inode);
+ rcu_read_unlock();
+ if (unlikely(!inode)) {
+ deactivate_super(sb);
rcu_read_lock();
+ continue;
}
+
+ d_prune_aliases(inode);
+ iput(inode);
+ deactivate_super(sb);
+
+ rcu_read_lock();
}
rcu_read_unlock();
- iput(prev);
}
/* called under sysctl_lock, will reacquire if has to wait */
@@ -464,7 +481,7 @@ static struct inode *proc_sys_make_inode
}
ei->sysctl = head;
ei->sysctl_entry = table;
- list_add_rcu(&ei->sysctl_inodes, &head->inodes);
+ hlist_add_head_rcu(&ei->sysctl_inodes, &head->inodes);
head->count++;
spin_unlock(&sysctl_lock);
@@ -492,7 +509,7 @@ out:
void proc_sys_evict_inode(struct inode *inode, struct ctl_table_header *head)
{
spin_lock(&sysctl_lock);
- list_del_rcu(&PROC_I(inode)->sysctl_inodes);
+ hlist_del_init_rcu(&PROC_I(inode)->sysctl_inodes);
if (!--head->count)
kfree_rcu(head, rcu);
spin_unlock(&sysctl_lock);
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -143,7 +143,7 @@ struct ctl_table_header
struct ctl_table_set *set;
struct ctl_dir *parent;
struct ctl_node *node;
- struct list_head inodes; /* head for proc_inode->sysctl_inodes */
+ struct hlist_head inodes; /* head for proc_inode->sysctl_inodes */
};
struct ctl_dir {
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 018/107] IB/core: Make testing MR flags for writability a static inline function
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 017/107] proc: Fix proc_sys_prune_dcache to hold a sb reference Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 019/107] IB/mlx4: Mark user MR as writable if actual virtual memory is writable Greg Kroah-Hartman
` (88 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Jack Morgenstein,
Leon Romanovsky, Sudip Mukherjee
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Morgenstein <jackm@dev.mellanox.co.il>
commit 08bb558ac11ab944e0539e78619d7b4c356278bd upstream.
Make the MR writability flags check, which is performed in umem.c,
a static inline function in file ib_verbs.h
This allows the function to be used by low-level infiniband drivers.
Cc: <stable@vger.kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/umem.c | 11 +----------
include/rdma/ib_verbs.h | 14 ++++++++++++++
2 files changed, 15 insertions(+), 10 deletions(-)
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -122,16 +122,7 @@ struct ib_umem *ib_umem_get(struct ib_uc
umem->address = addr;
umem->page_size = PAGE_SIZE;
umem->pid = get_task_pid(current, PIDTYPE_PID);
- /*
- * We ask for writable memory if any of the following
- * access flags are set. "Local write" and "remote write"
- * obviously require write access. "Remote atomic" can do
- * things like fetch and add, which will modify memory, and
- * "MW bind" can change permissions by binding a window.
- */
- umem->writable = !!(access &
- (IB_ACCESS_LOCAL_WRITE | IB_ACCESS_REMOTE_WRITE |
- IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_MW_BIND));
+ umem->writable = ib_access_writable(access);
if (access & IB_ACCESS_ON_DEMAND) {
put_pid(umem->pid);
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -3308,6 +3308,20 @@ static inline int ib_check_mr_access(int
return 0;
}
+static inline bool ib_access_writable(int access_flags)
+{
+ /*
+ * We have writable memory backing the MR if any of the following
+ * access flags are set. "Local write" and "remote write" obviously
+ * require write access. "Remote atomic" can do things like fetch and
+ * add, which will modify memory, and "MW bind" can change permissions
+ * by binding a window.
+ */
+ return access_flags &
+ (IB_ACCESS_LOCAL_WRITE | IB_ACCESS_REMOTE_WRITE |
+ IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_MW_BIND);
+}
+
/**
* ib_check_mr_status: lightweight check of MR status.
* This routine may provide status checks on a selected
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 019/107] IB/mlx4: Mark user MR as writable if actual virtual memory is writable
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 018/107] IB/core: Make testing MR flags for writability a static inline function Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 020/107] mtd: nand: qcom: Add a NULL check for devm_kasprintf() Greg Kroah-Hartman
` (87 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Jack Morgenstein,
Leon Romanovsky, Sudip Mukherjee
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Morgenstein <jackm@dev.mellanox.co.il>
commit d8f9cc328c8888369880e2527e9186d745f2bbf6 upstream.
To allow rereg_user_mr to modify the MR from read-only to writable without
using get_user_pages again, we needed to define the initial MR as writable.
However, this was originally done unconditionally, without taking into
account the writability of the underlying virtual memory.
As a result, any attempt to register a read-only MR over read-only
virtual memory failed.
To fix this, do not add the writable flag bit when the user virtual memory
is not writable (e.g. const memory).
However, when the underlying memory is NOT writable (and we therefore
do not define the initial MR as writable), the IB core adds a
"force writable" flag to its user-pages request. If this succeeds,
the reg_user_mr caller gets a writable copy of the original pages.
If the user-space caller then does a rereg_user_mr operation to enable
writability, this will succeed. This should not be allowed, since
the original virtual memory was not writable.
Cc: <stable@vger.kernel.org>
Fixes: 9376932d0c26 ("IB/mlx4_ib: Add support for user MR re-registration")
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx4/mr.c | 50 +++++++++++++++++++++++++++++++++-------
1 file changed, 42 insertions(+), 8 deletions(-)
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -131,6 +131,40 @@ out:
return err;
}
+static struct ib_umem *mlx4_get_umem_mr(struct ib_ucontext *context, u64 start,
+ u64 length, u64 virt_addr,
+ int access_flags)
+{
+ /*
+ * Force registering the memory as writable if the underlying pages
+ * are writable. This is so rereg can change the access permissions
+ * from readable to writable without having to run through ib_umem_get
+ * again
+ */
+ if (!ib_access_writable(access_flags)) {
+ struct vm_area_struct *vma;
+
+ down_read(¤t->mm->mmap_sem);
+ /*
+ * FIXME: Ideally this would iterate over all the vmas that
+ * cover the memory, but for now it requires a single vma to
+ * entirely cover the MR to support RO mappings.
+ */
+ vma = find_vma(current->mm, start);
+ if (vma && vma->vm_end >= start + length &&
+ vma->vm_start <= start) {
+ if (vma->vm_flags & VM_WRITE)
+ access_flags |= IB_ACCESS_LOCAL_WRITE;
+ } else {
+ access_flags |= IB_ACCESS_LOCAL_WRITE;
+ }
+
+ up_read(¤t->mm->mmap_sem);
+ }
+
+ return ib_umem_get(context, start, length, access_flags, 0);
+}
+
struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
u64 virt_addr, int access_flags,
struct ib_udata *udata)
@@ -145,10 +179,8 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct
if (!mr)
return ERR_PTR(-ENOMEM);
- /* Force registering the memory as writable. */
- /* Used for memory re-registeration. HCA protects the access */
- mr->umem = ib_umem_get(pd->uobject->context, start, length,
- access_flags | IB_ACCESS_LOCAL_WRITE, 0);
+ mr->umem = mlx4_get_umem_mr(pd->uobject->context, start, length,
+ virt_addr, access_flags);
if (IS_ERR(mr->umem)) {
err = PTR_ERR(mr->umem);
goto err_free;
@@ -215,6 +247,9 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *
}
if (flags & IB_MR_REREG_ACCESS) {
+ if (ib_access_writable(mr_access_flags) && !mmr->umem->writable)
+ return -EPERM;
+
err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry,
convert_access(mr_access_flags));
@@ -228,10 +263,9 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *
mlx4_mr_rereg_mem_cleanup(dev->dev, &mmr->mmr);
ib_umem_release(mmr->umem);
- mmr->umem = ib_umem_get(mr->uobject->context, start, length,
- mr_access_flags |
- IB_ACCESS_LOCAL_WRITE,
- 0);
+ mmr->umem =
+ mlx4_get_umem_mr(mr->uobject->context, start, length,
+ virt_addr, mr_access_flags);
if (IS_ERR(mmr->umem)) {
err = PTR_ERR(mmr->umem);
/* Prevent mlx4_ib_dereg_mr from free'ing invalid pointer */
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 020/107] mtd: nand: qcom: Add a NULL check for devm_kasprintf()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 019/107] IB/mlx4: Mark user MR as writable if actual virtual memory is writable Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 021/107] IB/ocrdma: fix out of bounds access to local buffer Greg Kroah-Hartman
` (86 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Boris Brezillon, Amit Pundir
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <fabio.estevam@nxp.com>
commit 069f05346d01e7298939f16533953cdf52370be3 upstream.
devm_kasprintf() may fail, so we should better add a NULL check
and propagate an error on failure.
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/qcom_nandc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/mtd/nand/qcom_nandc.c
+++ b/drivers/mtd/nand/qcom_nandc.c
@@ -2008,6 +2008,9 @@ static int qcom_nand_host_init(struct qc
nand_set_flash_node(chip, dn);
mtd->name = devm_kasprintf(dev, GFP_KERNEL, "qcom_nand.%d", host->cs);
+ if (!mtd->name)
+ return -ENOMEM;
+
mtd->owner = THIS_MODULE;
mtd->dev.parent = dev;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 021/107] IB/ocrdma: fix out of bounds access to local buffer
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 020/107] mtd: nand: qcom: Add a NULL check for devm_kasprintf() Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 022/107] ARM: dts: imx6sx: fix irq for pcie bridge Greg Kroah-Hartman
` (85 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Mera, Leon Romanovsky,
Doug Ledford, Amit Pundir
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Mera <dev@michaelmera.com>
commit 062d0f22a30c39840ea49b72cfcfc1aa4cc538fa upstream.
In write to debugfs file 'resource_stats' the local buffer 'tmp_str' is
written at index 'count-1' where 'count' is the size of the write, so
potentially 0.
This patch filters odd values for the write size/position to avoid this
type of problem.
Signed-off-by: Michael Mera <dev@michaelmera.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
@@ -645,7 +645,7 @@ static ssize_t ocrdma_dbgfs_ops_write(st
struct ocrdma_stats *pstats = filp->private_data;
struct ocrdma_dev *dev = pstats->dev;
- if (count > 32)
+ if (*ppos != 0 || count == 0 || count > sizeof(tmp_str))
goto err;
if (copy_from_user(tmp_str, buffer, count))
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 022/107] ARM: dts: imx6sx: fix irq for pcie bridge
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 021/107] IB/ocrdma: fix out of bounds access to local buffer Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 023/107] x86/paravirt: Fix spectre-v2 mitigations for paravirt guests Greg Kroah-Hartman
` (84 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleksij Rempel, Lucas Stach,
Shawn Guo, Amit Pundir
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <o.rempel@pengutronix.de>
commit 1bcfe0564044be578841744faea1c2f46adc8178 upstream.
Use the correct IRQ line for the MSI controller in the PCIe host
controller. Apparently a different IRQ line is used compared to other
i.MX6 variants. Without this change MSI IRQs aren't properly propagated
to the upstream interrupt controller.
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Fixes: b1d17f68e5c5 ("ARM: dts: imx: add initial imx6sx device tree source")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/imx6sx.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -1280,7 +1280,7 @@
/* non-prefetchable memory */
0x82000000 0 0x08000000 0x08000000 0 0x00f00000>;
num-lanes = <1>;
- interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&clks IMX6SX_CLK_PCIE_REF_125M>,
<&clks IMX6SX_CLK_PCIE_AXI>,
<&clks IMX6SX_CLK_LVDS1_OUT>,
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 023/107] x86/paravirt: Fix spectre-v2 mitigations for paravirt guests
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 022/107] ARM: dts: imx6sx: fix irq for pcie bridge Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 024/107] x86/speculation: Protect against userspace-userspace spectreRSB Greg Kroah-Hartman
` (83 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nadav Amit, Peter Zijlstra (Intel),
Thomas Gleixner, Juergen Gross, Konrad Rzeszutek Wilk,
Boris Ostrovsky, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 5800dc5c19f34e6e03b5adab1282535cb102fafd upstream.
Nadav reported that on guests we're failing to rewrite the indirect
calls to CALLEE_SAVE paravirt functions. In particular the
pv_queued_spin_unlock() call is left unpatched and that is all over the
place. This obviously wrecks Spectre-v2 mitigation (for paravirt
guests) which relies on not actually having indirect calls around.
The reason is an incorrect clobber test in paravirt_patch_call(); this
function rewrites an indirect call with a direct call to the _SAME_
function, there is no possible way the clobbers can be different
because of this.
Therefore remove this clobber check. Also put WARNs on the other patch
failure case (not enough room for the instruction) which I've not seen
trigger in my (limited) testing.
Three live kernel image disassemblies for lock_sock_nested (as a small
function that illustrates the problem nicely). PRE is the current
situation for guests, POST is with this patch applied and NATIVE is with
or without the patch for !guests.
PRE:
(gdb) disassemble lock_sock_nested
Dump of assembler code for function lock_sock_nested:
0xffffffff817be970 <+0>: push %rbp
0xffffffff817be971 <+1>: mov %rdi,%rbp
0xffffffff817be974 <+4>: push %rbx
0xffffffff817be975 <+5>: lea 0x88(%rbp),%rbx
0xffffffff817be97c <+12>: callq 0xffffffff819f7160 <_cond_resched>
0xffffffff817be981 <+17>: mov %rbx,%rdi
0xffffffff817be984 <+20>: callq 0xffffffff819fbb00 <_raw_spin_lock_bh>
0xffffffff817be989 <+25>: mov 0x8c(%rbp),%eax
0xffffffff817be98f <+31>: test %eax,%eax
0xffffffff817be991 <+33>: jne 0xffffffff817be9ba <lock_sock_nested+74>
0xffffffff817be993 <+35>: movl $0x1,0x8c(%rbp)
0xffffffff817be99d <+45>: mov %rbx,%rdi
0xffffffff817be9a0 <+48>: callq *0xffffffff822299e8
0xffffffff817be9a7 <+55>: pop %rbx
0xffffffff817be9a8 <+56>: pop %rbp
0xffffffff817be9a9 <+57>: mov $0x200,%esi
0xffffffff817be9ae <+62>: mov $0xffffffff817be993,%rdi
0xffffffff817be9b5 <+69>: jmpq 0xffffffff81063ae0 <__local_bh_enable_ip>
0xffffffff817be9ba <+74>: mov %rbp,%rdi
0xffffffff817be9bd <+77>: callq 0xffffffff817be8c0 <__lock_sock>
0xffffffff817be9c2 <+82>: jmp 0xffffffff817be993 <lock_sock_nested+35>
End of assembler dump.
POST:
(gdb) disassemble lock_sock_nested
Dump of assembler code for function lock_sock_nested:
0xffffffff817be970 <+0>: push %rbp
0xffffffff817be971 <+1>: mov %rdi,%rbp
0xffffffff817be974 <+4>: push %rbx
0xffffffff817be975 <+5>: lea 0x88(%rbp),%rbx
0xffffffff817be97c <+12>: callq 0xffffffff819f7160 <_cond_resched>
0xffffffff817be981 <+17>: mov %rbx,%rdi
0xffffffff817be984 <+20>: callq 0xffffffff819fbb00 <_raw_spin_lock_bh>
0xffffffff817be989 <+25>: mov 0x8c(%rbp),%eax
0xffffffff817be98f <+31>: test %eax,%eax
0xffffffff817be991 <+33>: jne 0xffffffff817be9ba <lock_sock_nested+74>
0xffffffff817be993 <+35>: movl $0x1,0x8c(%rbp)
0xffffffff817be99d <+45>: mov %rbx,%rdi
0xffffffff817be9a0 <+48>: callq 0xffffffff810a0c20 <__raw_callee_save___pv_queued_spin_unlock>
0xffffffff817be9a5 <+53>: xchg %ax,%ax
0xffffffff817be9a7 <+55>: pop %rbx
0xffffffff817be9a8 <+56>: pop %rbp
0xffffffff817be9a9 <+57>: mov $0x200,%esi
0xffffffff817be9ae <+62>: mov $0xffffffff817be993,%rdi
0xffffffff817be9b5 <+69>: jmpq 0xffffffff81063aa0 <__local_bh_enable_ip>
0xffffffff817be9ba <+74>: mov %rbp,%rdi
0xffffffff817be9bd <+77>: callq 0xffffffff817be8c0 <__lock_sock>
0xffffffff817be9c2 <+82>: jmp 0xffffffff817be993 <lock_sock_nested+35>
End of assembler dump.
NATIVE:
(gdb) disassemble lock_sock_nested
Dump of assembler code for function lock_sock_nested:
0xffffffff817be970 <+0>: push %rbp
0xffffffff817be971 <+1>: mov %rdi,%rbp
0xffffffff817be974 <+4>: push %rbx
0xffffffff817be975 <+5>: lea 0x88(%rbp),%rbx
0xffffffff817be97c <+12>: callq 0xffffffff819f7160 <_cond_resched>
0xffffffff817be981 <+17>: mov %rbx,%rdi
0xffffffff817be984 <+20>: callq 0xffffffff819fbb00 <_raw_spin_lock_bh>
0xffffffff817be989 <+25>: mov 0x8c(%rbp),%eax
0xffffffff817be98f <+31>: test %eax,%eax
0xffffffff817be991 <+33>: jne 0xffffffff817be9ba <lock_sock_nested+74>
0xffffffff817be993 <+35>: movl $0x1,0x8c(%rbp)
0xffffffff817be99d <+45>: mov %rbx,%rdi
0xffffffff817be9a0 <+48>: movb $0x0,(%rdi)
0xffffffff817be9a3 <+51>: nopl 0x0(%rax)
0xffffffff817be9a7 <+55>: pop %rbx
0xffffffff817be9a8 <+56>: pop %rbp
0xffffffff817be9a9 <+57>: mov $0x200,%esi
0xffffffff817be9ae <+62>: mov $0xffffffff817be993,%rdi
0xffffffff817be9b5 <+69>: jmpq 0xffffffff81063ae0 <__local_bh_enable_ip>
0xffffffff817be9ba <+74>: mov %rbp,%rdi
0xffffffff817be9bd <+77>: callq 0xffffffff817be8c0 <__lock_sock>
0xffffffff817be9c2 <+82>: jmp 0xffffffff817be993 <lock_sock_nested+35>
End of assembler dump.
Fixes: 63f70270ccd9 ("[PATCH] i386: PARAVIRT: add common patching machinery")
Fixes: 3010a0663fd9 ("x86/paravirt, objtool: Annotate indirect calls")
Reported-by: Nadav Amit <namit@vmware.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/paravirt.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -88,10 +88,12 @@ unsigned paravirt_patch_call(void *insnb
struct branch *b = insnbuf;
unsigned long delta = (unsigned long)target - (addr+5);
- if (tgt_clobbers & ~site_clobbers)
- return len; /* target would clobber too much for this site */
- if (len < 5)
+ if (len < 5) {
+#ifdef CONFIG_RETPOLINE
+ WARN_ONCE("Failing to patch indirect CALL in %ps\n", (void *)addr);
+#endif
return len; /* call too long for patch site */
+ }
b->opcode = 0xe8; /* call */
b->delta = delta;
@@ -106,8 +108,12 @@ unsigned paravirt_patch_jmp(void *insnbu
struct branch *b = insnbuf;
unsigned long delta = (unsigned long)target - (addr+5);
- if (len < 5)
+ if (len < 5) {
+#ifdef CONFIG_RETPOLINE
+ WARN_ONCE("Failing to patch indirect JMP in %ps\n", (void *)addr);
+#endif
return len; /* call too long for patch site */
+ }
b->opcode = 0xe9; /* jmp */
b->delta = delta;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 024/107] x86/speculation: Protect against userspace-userspace spectreRSB
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 023/107] x86/paravirt: Fix spectre-v2 mitigations for paravirt guests Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 025/107] kprobes/x86: Fix %p uses in error messages Greg Kroah-Hartman
` (82 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Kosina, Thomas Gleixner,
Josh Poimboeuf, Tim Chen, Konrad Rzeszutek Wilk, Borislav Petkov,
David Woodhouse, Peter Zijlstra, Linus Torvalds
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.cz>
commit fdf82a7856b32d905c39afc85e34364491e46346 upstream.
The article "Spectre Returns! Speculation Attacks using the Return Stack
Buffer" [1] describes two new (sub-)variants of spectrev2-like attacks,
making use solely of the RSB contents even on CPUs that don't fallback to
BTB on RSB underflow (Skylake+).
Mitigate userspace-userspace attacks by always unconditionally filling RSB on
context switch when the generic spectrev2 mitigation has been enabled.
[1] https://arxiv.org/pdf/1807.07940.pdf
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Tim Chen <tim.c.chen@linux.intel.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/nycvar.YFH.7.76.1807261308190.997@cbobk.fhfr.pm
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/bugs.c | 38 +++++++-------------------------------
1 file changed, 7 insertions(+), 31 deletions(-)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -310,23 +310,6 @@ static enum spectre_v2_mitigation_cmd __
return cmd;
}
-/* Check for Skylake-like CPUs (for RSB handling) */
-static bool __init is_skylake_era(void)
-{
- if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
- boot_cpu_data.x86 == 6) {
- switch (boot_cpu_data.x86_model) {
- case INTEL_FAM6_SKYLAKE_MOBILE:
- case INTEL_FAM6_SKYLAKE_DESKTOP:
- case INTEL_FAM6_SKYLAKE_X:
- case INTEL_FAM6_KABYLAKE_MOBILE:
- case INTEL_FAM6_KABYLAKE_DESKTOP:
- return true;
- }
- }
- return false;
-}
-
static void __init spectre_v2_select_mitigation(void)
{
enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
@@ -387,22 +370,15 @@ retpoline_auto:
pr_info("%s\n", spectre_v2_strings[mode]);
/*
- * If neither SMEP nor PTI are available, there is a risk of
- * hitting userspace addresses in the RSB after a context switch
- * from a shallow call stack to a deeper one. To prevent this fill
- * the entire RSB, even when using IBRS.
+ * If spectre v2 protection has been enabled, unconditionally fill
+ * RSB during a context switch; this protects against two independent
+ * issues:
*
- * Skylake era CPUs have a separate issue with *underflow* of the
- * RSB, when they will predict 'ret' targets from the generic BTB.
- * The proper mitigation for this is IBRS. If IBRS is not supported
- * or deactivated in favour of retpolines the RSB fill on context
- * switch is required.
+ * - RSB underflow (and switch to BTB) on Skylake+
+ * - SpectreRSB variant of spectre v2 on X86_BUG_SPECTRE_V2 CPUs
*/
- if ((!boot_cpu_has(X86_FEATURE_KAISER) &&
- !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
- setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
- pr_info("Spectre v2 mitigation: Filling RSB on context switch\n");
- }
+ setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
+ pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
/* Initialize Indirect Branch Prediction Barrier if supported */
if (boot_cpu_has(X86_FEATURE_IBPB)) {
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 025/107] kprobes/x86: Fix %p uses in error messages
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 024/107] x86/speculation: Protect against userspace-userspace spectreRSB Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 026/107] x86/irqflags: Provide a declaration for native_save_fl Greg Kroah-Hartman
` (81 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masami Hiramatsu,
Ananth N Mavinakayanahalli, Anil S Keshavamurthy, Arnd Bergmann,
David Howells, David S . Miller, Heiko Carstens, Jon Medhurst,
Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Thomas Richter,
Tobin C . Harding, Will Deacon, acme, akpm, brueckner,
linux-arch, rostedt, schwidefsky, Ingo Molnar
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <mhiramat@kernel.org>
commit 0ea063306eecf300fcf06d2f5917474b580f666f upstream.
Remove all %p uses in error messages in kprobes/x86.
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: David Howells <dhowells@redhat.com>
Cc: David S . Miller <davem@davemloft.net>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Jon Medhurst <tixy@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Cc: Tobin C . Harding <me@tobin.cc>
Cc: Will Deacon <will.deacon@arm.com>
Cc: acme@kernel.org
Cc: akpm@linux-foundation.org
Cc: brueckner@linux.vnet.ibm.com
Cc: linux-arch@vger.kernel.org
Cc: rostedt@goodmis.org
Cc: schwidefsky@de.ibm.com
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/lkml/152491902310.9916.13355297638917767319.stgit@devbox
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/kprobes/core.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -396,7 +396,6 @@ int __copy_instruction(u8 *dest, u8 *src
newdisp = (u8 *) src + (s64) insn.displacement.value - (u8 *) dest;
if ((s64) (s32) newdisp != newdisp) {
pr_err("Kprobes error: new displacement does not fit into s32 (%llx)\n", newdisp);
- pr_err("\tSrc: %p, Dest: %p, old disp: %x\n", src, dest, insn.displacement.value);
return 0;
}
disp = (u8 *) dest + insn_offset_displacement(&insn);
@@ -612,8 +611,7 @@ static int reenter_kprobe(struct kprobe
* Raise a BUG or we'll continue in an endless reentering loop
* and eventually a stack overflow.
*/
- printk(KERN_WARNING "Unrecoverable kprobe detected at %p.\n",
- p->addr);
+ pr_err("Unrecoverable kprobe detected.\n");
dump_kprobe(p);
BUG();
default:
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 026/107] x86/irqflags: Provide a declaration for native_save_fl
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 025/107] kprobes/x86: Fix %p uses in error messages Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 027/107] x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT Greg Kroah-Hartman
` (80 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Laight, Jean Delvare,
Nick Desaulniers, Thomas Gleixner, hpa, jgross, kstewart,
boris.ostrovsky, astrachan, mka, arnd, tstellar, sedat.dilek,
David.Laight
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Desaulniers <ndesaulniers@google.com>
commit 208cbb32558907f68b3b2a081ca2337ac3744794 upstream.
It was reported that the commit d0a8d9378d16 is causing users of gcc < 4.9
to observe -Werror=missing-prototypes errors.
Indeed, it seems that:
extern inline unsigned long native_save_fl(void) { return 0; }
compiled with -Werror=missing-prototypes produces this warning in gcc <
4.9, but not gcc >= 4.9.
Fixes: d0a8d9378d16 ("x86/paravirt: Make native_save_fl() extern inline").
Reported-by: David Laight <david.laight@aculab.com>
Reported-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: hpa@zytor.com
Cc: jgross@suse.com
Cc: kstewart@linuxfoundation.org
Cc: gregkh@linuxfoundation.org
Cc: boris.ostrovsky@oracle.com
Cc: astrachan@google.com
Cc: mka@chromium.org
Cc: arnd@arndb.de
Cc: tstellar@redhat.com
Cc: sedat.dilek@gmail.com
Cc: David.Laight@aculab.com
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20180803170550.164688-1-ndesaulniers@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/irqflags.h | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/include/asm/irqflags.h
+++ b/arch/x86/include/asm/irqflags.h
@@ -12,6 +12,8 @@
* Interrupt control:
*/
+/* Declaration required for gcc < 4.9 to prevent -Werror=missing-prototypes */
+extern inline unsigned long native_save_fl(void);
extern inline unsigned long native_save_fl(void)
{
unsigned long flags;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 027/107] x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 026/107] x86/irqflags: Provide a declaration for native_save_fl Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 028/107] mm: x86: move _PAGE_SWP_SOFT_DIRTY from bit 7 to bit 1 Greg Kroah-Hartman
` (79 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner,
Josh Poimboeuf, Michal Hocko, Dave Hansen, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit 50896e180c6aa3a9c61a26ced99e15d602666a4c upstream
L1 Terminal Fault (L1TF) is a speculation related vulnerability. The CPU
speculates on PTE entries which do not have the PRESENT bit set, if the
content of the resulting physical address is available in the L1D cache.
The OS side mitigation makes sure that a !PRESENT PTE entry points to a
physical address outside the actually existing and cachable memory
space. This is achieved by inverting the upper bits of the PTE. Due to the
address space limitations this only works for 64bit and 32bit PAE kernels,
but not for 32bit non PAE.
This mitigation applies to both host and guest kernels, but in case of a
64bit host (hypervisor) and a 32bit PAE guest, inverting the upper bits of
the PAE address space (44bit) is not enough if the host has more than 43
bits of populated memory address space, because the speculation treats the
PTE content as a physical host address bypassing EPT.
The host (hypervisor) protects itself against the guest by flushing L1D as
needed, but pages inside the guest are not protected against attacks from
other processes inside the same guest.
For the guest the inverted PTE mask has to match the host to provide the
full protection for all pages the host could possibly map into the
guest. The hosts populated address space is not known to the guest, so the
mask must cover the possible maximal host address space, i.e. 52 bit.
On 32bit PAE the maximum PTE mask is currently set to 44 bit because that
is the limit imposed by 32bit unsigned long PFNs in the VMs. This limits
the mask to be below what the host could possible use for physical pages.
The L1TF PROT_NONE protection code uses the PTE masks to determine which
bits to invert to make sure the higher bits are set for unmapped entries to
prevent L1TF speculation attacks against EPT inside guests.
In order to invert all bits that could be used by the host, increase
__PHYSICAL_PAGE_SHIFT to 52 to match 64bit.
The real limit for a 32bit PAE kernel is still 44 bits because all Linux
PTEs are created from unsigned long PFNs, so they cannot be higher than 44
bits on a 32bit kernel. So these extra PFN bits should be never set. The
only users of this macro are using it to look at PTEs, so it's safe.
[ tglx: Massaged changelog ]
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/page_32_types.h | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/page_32_types.h
+++ b/arch/x86/include/asm/page_32_types.h
@@ -28,8 +28,13 @@
#define N_EXCEPTION_STACKS 1
#ifdef CONFIG_X86_PAE
-/* 44=32+12, the limit we can fit into an unsigned long pfn */
-#define __PHYSICAL_MASK_SHIFT 44
+/*
+ * This is beyond the 44 bit limit imposed by the 32bit long pfns,
+ * but we need the full mask to make sure inverted PROT_NONE
+ * entries have all the host bits set in a guest.
+ * The real limit is still 44 bits.
+ */
+#define __PHYSICAL_MASK_SHIFT 52
#define __VIRTUAL_MASK_SHIFT 32
#else /* !CONFIG_X86_PAE */
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 028/107] mm: x86: move _PAGE_SWP_SOFT_DIRTY from bit 7 to bit 1
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 027/107] x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 029/107] x86/speculation/l1tf: Change order of offset/type in swap entry Greg Kroah-Hartman
` (78 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Naoya Horiguchi, Zi Yan, Dave Hansen,
H. Peter Anvin, Anshuman Khandual, David Nellans, Ingo Molnar,
Kirill A. Shutemov, Mel Gorman, Minchan Kim, Thomas Gleixner,
Vlastimil Babka, Andrea Arcangeli, Michal Hocko, Andrew Morton,
Linus Torvalds, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
commit eee4818baac0f2b37848fdf90e4b16430dc536ac upstream
_PAGE_PSE is used to distinguish between a truly non-present
(_PAGE_PRESENT=0) PMD, and a PMD which is undergoing a THP split and
should be treated as present.
But _PAGE_SWP_SOFT_DIRTY currently uses the _PAGE_PSE bit, which would
cause confusion between one of those PMDs undergoing a THP split, and a
soft-dirty PMD. Dropping _PAGE_PSE check in pmd_present() does not work
well, because it can hurt optimization of tlb handling in thp split.
Thus, we need to move the bit.
In the current kernel, bits 1-4 are not used in non-present format since
commit 00839ee3b299 ("x86/mm: Move swap offset/type up in PTE to work
around erratum"). So let's move _PAGE_SWP_SOFT_DIRTY to bit 1. Bit 7
is used as reserved (always clear), so please don't use it for other
purpose.
[dwmw2: Pulled in to 4.9 backport to support L1TF changes]
Link: http://lkml.kernel.org/r/20170717193955.20207-3-zi.yan@sent.com
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Zi Yan <zi.yan@cs.rutgers.edu>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Anshuman Khandual <khandual@linux.vnet.ibm.com>
Cc: David Nellans <dnellans@nvidia.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable_64.h | 12 +++++++++---
arch/x86/include/asm/pgtable_types.h | 10 +++++-----
2 files changed, 14 insertions(+), 8 deletions(-)
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -166,15 +166,21 @@ static inline int pgd_large(pgd_t pgd) {
/*
* Encode and de-code a swap entry
*
- * | ... | 11| 10| 9|8|7|6|5| 4| 3|2|1|0| <- bit number
- * | ... |SW3|SW2|SW1|G|L|D|A|CD|WT|U|W|P| <- bit names
- * | OFFSET (14->63) | TYPE (9-13) |0|X|X|X| X| X|X|X|0| <- swp entry
+ * | ... | 11| 10| 9|8|7|6|5| 4| 3|2| 1|0| <- bit number
+ * | ... |SW3|SW2|SW1|G|L|D|A|CD|WT|U| W|P| <- bit names
+ * | OFFSET (14->63) | TYPE (9-13) |0|0|X|X| X| X|X|SD|0| <- swp entry
*
* G (8) is aliased and used as a PROT_NONE indicator for
* !present ptes. We need to start storing swap entries above
* there. We also need to avoid using A and D because of an
* erratum where they can be incorrectly set by hardware on
* non-present PTEs.
+ *
+ * SD (1) in swp entry is used to store soft dirty bit, which helps us
+ * remember soft dirty over page migration
+ *
+ * Bit 7 in swp entry should be 0 because pmd_present checks not only P,
+ * but also L and G.
*/
#define SWP_TYPE_FIRST_BIT (_PAGE_BIT_PROTNONE + 1)
#define SWP_TYPE_BITS 5
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -97,15 +97,15 @@
/*
* Tracking soft dirty bit when a page goes to a swap is tricky.
* We need a bit which can be stored in pte _and_ not conflict
- * with swap entry format. On x86 bits 6 and 7 are *not* involved
- * into swap entry computation, but bit 6 is used for nonlinear
- * file mapping, so we borrow bit 7 for soft dirty tracking.
+ * with swap entry format. On x86 bits 1-4 are *not* involved
+ * into swap entry computation, but bit 7 is used for thp migration,
+ * so we borrow bit 1 for soft dirty tracking.
*
* Please note that this bit must be treated as swap dirty page
- * mark if and only if the PTE has present bit clear!
+ * mark if and only if the PTE/PMD has present bit clear!
*/
#ifdef CONFIG_MEM_SOFT_DIRTY
-#define _PAGE_SWP_SOFT_DIRTY _PAGE_PSE
+#define _PAGE_SWP_SOFT_DIRTY _PAGE_RW
#else
#define _PAGE_SWP_SOFT_DIRTY (_AT(pteval_t, 0))
#endif
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 029/107] x86/speculation/l1tf: Change order of offset/type in swap entry
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 028/107] mm: x86: move _PAGE_SWP_SOFT_DIRTY from bit 7 to bit 1 Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 030/107] x86/speculation/l1tf: Protect swap entries against L1TF Greg Kroah-Hartman
` (77 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Linus Torvalds, Andi Kleen,
Thomas Gleixner, Josh Poimboeuf, Michal Hocko, Vlastimil Babka,
Dave Hansen, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit bcd11afa7adad8d720e7ba5ef58bdcd9775cf45f upstream
If pages are swapped out, the swap entry is stored in the corresponding
PTE, which has the Present bit cleared. CPUs vulnerable to L1TF speculate
on PTE entries which have the present bit set and would treat the swap
entry as phsyical address (PFN). To mitigate that the upper bits of the PTE
must be set so the PTE points to non existent memory.
The swap entry stores the type and the offset of a swapped out page in the
PTE. type is stored in bit 9-13 and offset in bit 14-63. The hardware
ignores the bits beyond the phsyical address space limit, so to make the
mitigation effective its required to start 'offset' at the lowest possible
bit so that even large swap offsets do not reach into the physical address
space limit bits.
Move offset to bit 9-58 and type to bit 59-63 which are the bits that
hardware generally doesn't care about.
That, in turn, means that if you on desktop chip with only 40 bits of
physical addressing, now that the offset starts at bit 9, there needs to be
30 bits of offset actually *in use* until bit 39 ends up being set, which
means when inverted it will again point into existing memory.
So that's 4 terabyte of swap space (because the offset is counted in pages,
so 30 bits of offset is 42 bits of actual coverage). With bigger physical
addressing, that obviously grows further, until the limit of the offset is
hit (at 50 bits of offset - 62 bits of actual swap file coverage).
This is a preparatory change for the actual swap entry inversion to protect
against L1TF.
[ AK: Updated description and minor tweaks. Split into two parts ]
[ tglx: Massaged changelog ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Andi Kleen <ak@linux.intel.com>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable_64.h | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -168,7 +168,7 @@ static inline int pgd_large(pgd_t pgd) {
*
* | ... | 11| 10| 9|8|7|6|5| 4| 3|2| 1|0| <- bit number
* | ... |SW3|SW2|SW1|G|L|D|A|CD|WT|U| W|P| <- bit names
- * | OFFSET (14->63) | TYPE (9-13) |0|0|X|X| X| X|X|SD|0| <- swp entry
+ * | TYPE (59-63) | OFFSET (9-58) |0|0|X|X| X| X|X|SD|0| <- swp entry
*
* G (8) is aliased and used as a PROT_NONE indicator for
* !present ptes. We need to start storing swap entries above
@@ -182,19 +182,28 @@ static inline int pgd_large(pgd_t pgd) {
* Bit 7 in swp entry should be 0 because pmd_present checks not only P,
* but also L and G.
*/
-#define SWP_TYPE_FIRST_BIT (_PAGE_BIT_PROTNONE + 1)
-#define SWP_TYPE_BITS 5
-/* Place the offset above the type: */
-#define SWP_OFFSET_FIRST_BIT (SWP_TYPE_FIRST_BIT + SWP_TYPE_BITS)
+#define SWP_TYPE_BITS 5
+
+#define SWP_OFFSET_FIRST_BIT (_PAGE_BIT_PROTNONE + 1)
+
+/* We always extract/encode the offset by shifting it all the way up, and then down again */
+#define SWP_OFFSET_SHIFT (SWP_OFFSET_FIRST_BIT+SWP_TYPE_BITS)
#define MAX_SWAPFILES_CHECK() BUILD_BUG_ON(MAX_SWAPFILES_SHIFT > SWP_TYPE_BITS)
-#define __swp_type(x) (((x).val >> (SWP_TYPE_FIRST_BIT)) \
- & ((1U << SWP_TYPE_BITS) - 1))
-#define __swp_offset(x) ((x).val >> SWP_OFFSET_FIRST_BIT)
-#define __swp_entry(type, offset) ((swp_entry_t) { \
- ((type) << (SWP_TYPE_FIRST_BIT)) \
- | ((offset) << SWP_OFFSET_FIRST_BIT) })
+/* Extract the high bits for type */
+#define __swp_type(x) ((x).val >> (64 - SWP_TYPE_BITS))
+
+/* Shift up (to get rid of type), then down to get value */
+#define __swp_offset(x) ((x).val << SWP_TYPE_BITS >> SWP_OFFSET_SHIFT)
+
+/*
+ * Shift the offset up "too far" by TYPE bits, then down again
+ */
+#define __swp_entry(type, offset) ((swp_entry_t) { \
+ ((unsigned long)(offset) << SWP_OFFSET_SHIFT >> SWP_TYPE_BITS) \
+ | ((unsigned long)(type) << (64-SWP_TYPE_BITS)) })
+
#define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val((pte)) })
#define __swp_entry_to_pte(x) ((pte_t) { .pte = (x).val })
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 030/107] x86/speculation/l1tf: Protect swap entries against L1TF
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 029/107] x86/speculation/l1tf: Change order of offset/type in swap entry Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 031/107] x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation Greg Kroah-Hartman
` (76 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Linus Torvalds, Andi Kleen,
Thomas Gleixner, Josh Poimboeuf, Michal Hocko, Vlastimil Babka,
Dave Hansen, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 2f22b4cd45b67b3496f4aa4c7180a1271c6452f6 upstream
With L1 terminal fault the CPU speculates into unmapped PTEs, and resulting
side effects allow to read the memory the PTE is pointing too, if its
values are still in the L1 cache.
For swapped out pages Linux uses unmapped PTEs and stores a swap entry into
them.
To protect against L1TF it must be ensured that the swap entry is not
pointing to valid memory, which requires setting higher bits (between bit
36 and bit 45) that are inside the CPUs physical address space, but outside
any real memory.
To do this invert the offset to make sure the higher bits are always set,
as long as the swap file is not too big.
Note there is no workaround for 32bit !PAE, or on systems which have more
than MAX_PA/2 worth of memory. The later case is very unlikely to happen on
real systems.
[AK: updated description and minor tweaks by. Split out from the original
patch ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Andi Kleen <ak@linux.intel.com>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable_64.h | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -168,7 +168,7 @@ static inline int pgd_large(pgd_t pgd) {
*
* | ... | 11| 10| 9|8|7|6|5| 4| 3|2| 1|0| <- bit number
* | ... |SW3|SW2|SW1|G|L|D|A|CD|WT|U| W|P| <- bit names
- * | TYPE (59-63) | OFFSET (9-58) |0|0|X|X| X| X|X|SD|0| <- swp entry
+ * | TYPE (59-63) | ~OFFSET (9-58) |0|0|X|X| X| X|X|SD|0| <- swp entry
*
* G (8) is aliased and used as a PROT_NONE indicator for
* !present ptes. We need to start storing swap entries above
@@ -181,6 +181,9 @@ static inline int pgd_large(pgd_t pgd) {
*
* Bit 7 in swp entry should be 0 because pmd_present checks not only P,
* but also L and G.
+ *
+ * The offset is inverted by a binary not operation to make the high
+ * physical bits set.
*/
#define SWP_TYPE_BITS 5
@@ -195,13 +198,15 @@ static inline int pgd_large(pgd_t pgd) {
#define __swp_type(x) ((x).val >> (64 - SWP_TYPE_BITS))
/* Shift up (to get rid of type), then down to get value */
-#define __swp_offset(x) ((x).val << SWP_TYPE_BITS >> SWP_OFFSET_SHIFT)
+#define __swp_offset(x) (~(x).val << SWP_TYPE_BITS >> SWP_OFFSET_SHIFT)
/*
* Shift the offset up "too far" by TYPE bits, then down again
+ * The offset is inverted by a binary not operation to make the high
+ * physical bits set.
*/
#define __swp_entry(type, offset) ((swp_entry_t) { \
- ((unsigned long)(offset) << SWP_OFFSET_SHIFT >> SWP_TYPE_BITS) \
+ (~(unsigned long)(offset) << SWP_OFFSET_SHIFT >> SWP_TYPE_BITS) \
| ((unsigned long)(type) << (64-SWP_TYPE_BITS)) })
#define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val((pte)) })
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 031/107] x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 030/107] x86/speculation/l1tf: Protect swap entries against L1TF Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 032/107] x86/speculation/l1tf: Make sure the first page is always reserved Greg Kroah-Hartman
` (75 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner,
Josh Poimboeuf, Michal Hocko, Vlastimil Babka, Dave Hansen,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit 6b28baca9b1f0d4a42b865da7a05b1c81424bd5c upstream
When PTEs are set to PROT_NONE the kernel just clears the Present bit and
preserves the PFN, which creates attack surface for L1TF speculation
speculation attacks.
This is important inside guests, because L1TF speculation bypasses physical
page remapping. While the host has its own migitations preventing leaking
data from other VMs into the guest, this would still risk leaking the wrong
page inside the current guest.
This uses the same technique as Linus' swap entry patch: while an entry is
is in PROTNONE state invert the complete PFN part part of it. This ensures
that the the highest bit will point to non existing memory.
The invert is done by pte/pmd_modify and pfn/pmd/pud_pte for PROTNONE and
pte/pmd/pud_pfn undo it.
This assume that no code path touches the PFN part of a PTE directly
without using these primitives.
This doesn't handle the case that MMIO is on the top of the CPU physical
memory. If such an MMIO region was exposed by an unpriviledged driver for
mmap it would be possible to attack some real memory. However this
situation is all rather unlikely.
For 32bit non PAE the inversion is not done because there are really not
enough bits to protect anything.
Q: Why does the guest need to be protected when the HyperVisor already has
L1TF mitigations?
A: Here's an example:
Physical pages 1 2 get mapped into a guest as
GPA 1 -> PA 2
GPA 2 -> PA 1
through EPT.
The L1TF speculation ignores the EPT remapping.
Now the guest kernel maps GPA 1 to process A and GPA 2 to process B, and
they belong to different users and should be isolated.
A sets the GPA 1 PA 2 PTE to PROT_NONE to bypass the EPT remapping and
gets read access to the underlying physical page. Which in this case
points to PA 2, so it can read process B's data, if it happened to be in
L1, so isolation inside the guest is broken.
There's nothing the hypervisor can do about this. This mitigation has to
be done in the guest itself.
[ tglx: Massaged changelog ]
[ dwmw2: backported to 4.9 ]
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable-2level.h | 17 +++++++++++++++
arch/x86/include/asm/pgtable-3level.h | 2 +
arch/x86/include/asm/pgtable-invert.h | 32 ++++++++++++++++++++++++++++
arch/x86/include/asm/pgtable.h | 38 ++++++++++++++++++++++++----------
arch/x86/include/asm/pgtable_64.h | 2 +
5 files changed, 80 insertions(+), 11 deletions(-)
create mode 100644 arch/x86/include/asm/pgtable-invert.h
--- a/arch/x86/include/asm/pgtable-2level.h
+++ b/arch/x86/include/asm/pgtable-2level.h
@@ -77,4 +77,21 @@ static inline unsigned long pte_bitop(un
#define __pte_to_swp_entry(pte) ((swp_entry_t) { (pte).pte_low })
#define __swp_entry_to_pte(x) ((pte_t) { .pte = (x).val })
+/* No inverted PFNs on 2 level page tables */
+
+static inline u64 protnone_mask(u64 val)
+{
+ return 0;
+}
+
+static inline u64 flip_protnone_guard(u64 oldval, u64 val, u64 mask)
+{
+ return val;
+}
+
+static inline bool __pte_needs_invert(u64 val)
+{
+ return false;
+}
+
#endif /* _ASM_X86_PGTABLE_2LEVEL_H */
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -184,4 +184,6 @@ static inline pmd_t native_pmdp_get_and_
#define __pte_to_swp_entry(pte) ((swp_entry_t){ (pte).pte_high })
#define __swp_entry_to_pte(x) ((pte_t){ { .pte_high = (x).val } })
+#include <asm/pgtable-invert.h>
+
#endif /* _ASM_X86_PGTABLE_3LEVEL_H */
--- /dev/null
+++ b/arch/x86/include/asm/pgtable-invert.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_PGTABLE_INVERT_H
+#define _ASM_PGTABLE_INVERT_H 1
+
+#ifndef __ASSEMBLY__
+
+static inline bool __pte_needs_invert(u64 val)
+{
+ return (val & (_PAGE_PRESENT|_PAGE_PROTNONE)) == _PAGE_PROTNONE;
+}
+
+/* Get a mask to xor with the page table entry to get the correct pfn. */
+static inline u64 protnone_mask(u64 val)
+{
+ return __pte_needs_invert(val) ? ~0ull : 0;
+}
+
+static inline u64 flip_protnone_guard(u64 oldval, u64 val, u64 mask)
+{
+ /*
+ * When a PTE transitions from NONE to !NONE or vice-versa
+ * invert the PFN part to stop speculation.
+ * pte_pfn undoes this when needed.
+ */
+ if (__pte_needs_invert(oldval) != __pte_needs_invert(val))
+ val = (val & ~mask) | (~val & mask);
+ return val;
+}
+
+#endif /* __ASSEMBLY__ */
+
+#endif
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -165,19 +165,29 @@ static inline int pte_special(pte_t pte)
return pte_flags(pte) & _PAGE_SPECIAL;
}
+/* Entries that were set to PROT_NONE are inverted */
+
+static inline u64 protnone_mask(u64 val);
+
static inline unsigned long pte_pfn(pte_t pte)
{
- return (pte_val(pte) & PTE_PFN_MASK) >> PAGE_SHIFT;
+ unsigned long pfn = pte_val(pte);
+ pfn ^= protnone_mask(pfn);
+ return (pfn & PTE_PFN_MASK) >> PAGE_SHIFT;
}
static inline unsigned long pmd_pfn(pmd_t pmd)
{
- return (pmd_val(pmd) & pmd_pfn_mask(pmd)) >> PAGE_SHIFT;
+ unsigned long pfn = pmd_val(pmd);
+ pfn ^= protnone_mask(pfn);
+ return (pfn & pmd_pfn_mask(pmd)) >> PAGE_SHIFT;
}
static inline unsigned long pud_pfn(pud_t pud)
{
- return (pud_val(pud) & pud_pfn_mask(pud)) >> PAGE_SHIFT;
+ unsigned long pfn = pud_val(pud);
+ pfn ^= protnone_mask(pfn);
+ return (pfn & pud_pfn_mask(pud)) >> PAGE_SHIFT;
}
#define pte_page(pte) pfn_to_page(pte_pfn(pte))
@@ -394,19 +404,25 @@ static inline pgprotval_t massage_pgprot
static inline pte_t pfn_pte(unsigned long page_nr, pgprot_t pgprot)
{
- return __pte(((phys_addr_t)page_nr << PAGE_SHIFT) |
- massage_pgprot(pgprot));
+ phys_addr_t pfn = page_nr << PAGE_SHIFT;
+ pfn ^= protnone_mask(pgprot_val(pgprot));
+ pfn &= PTE_PFN_MASK;
+ return __pte(pfn | massage_pgprot(pgprot));
}
static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot)
{
- return __pmd(((phys_addr_t)page_nr << PAGE_SHIFT) |
- massage_pgprot(pgprot));
+ phys_addr_t pfn = page_nr << PAGE_SHIFT;
+ pfn ^= protnone_mask(pgprot_val(pgprot));
+ pfn &= PHYSICAL_PMD_PAGE_MASK;
+ return __pmd(pfn | massage_pgprot(pgprot));
}
+static inline u64 flip_protnone_guard(u64 oldval, u64 val, u64 mask);
+
static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
{
- pteval_t val = pte_val(pte);
+ pteval_t val = pte_val(pte), oldval = val;
/*
* Chop off the NX bit (if present), and add the NX portion of
@@ -414,17 +430,17 @@ static inline pte_t pte_modify(pte_t pte
*/
val &= _PAGE_CHG_MASK;
val |= massage_pgprot(newprot) & ~_PAGE_CHG_MASK;
-
+ val = flip_protnone_guard(oldval, val, PTE_PFN_MASK);
return __pte(val);
}
static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
{
- pmdval_t val = pmd_val(pmd);
+ pmdval_t val = pmd_val(pmd), oldval = val;
val &= _HPAGE_CHG_MASK;
val |= massage_pgprot(newprot) & ~_HPAGE_CHG_MASK;
-
+ val = flip_protnone_guard(oldval, val, PHYSICAL_PMD_PAGE_MASK);
return __pmd(val);
}
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -235,6 +235,8 @@ extern void cleanup_highmap(void);
extern void init_extra_mapping_uc(unsigned long phys, unsigned long size);
extern void init_extra_mapping_wb(unsigned long phys, unsigned long size);
+#include <asm/pgtable-invert.h>
+
#endif /* !__ASSEMBLY__ */
#endif /* _ASM_X86_PGTABLE_64_H */
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 032/107] x86/speculation/l1tf: Make sure the first page is always reserved
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 031/107] x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 033/107] x86/speculation/l1tf: Add sysfs reporting for l1tf Greg Kroah-Hartman
` (74 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner,
Josh Poimboeuf, Dave Hansen, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit 10a70416e1f067f6c4efda6ffd8ea96002ac4223 upstream
The L1TF workaround doesn't make any attempt to mitigate speculate accesses
to the first physical page for zeroed PTEs. Normally it only contains some
data from the early real mode BIOS.
It's not entirely clear that the first page is reserved in all
configurations, so add an extra reservation call to make sure it is really
reserved. In most configurations (e.g. with the standard reservations)
it's likely a nop.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/setup.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -854,6 +854,12 @@ void __init setup_arch(char **cmdline_p)
memblock_reserve(__pa_symbol(_text),
(unsigned long)__bss_stop - (unsigned long)_text);
+ /*
+ * Make sure page 0 is always reserved because on systems with
+ * L1TF its contents can be leaked to user processes.
+ */
+ memblock_reserve(0, PAGE_SIZE);
+
early_reserve_initrd();
/*
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 033/107] x86/speculation/l1tf: Add sysfs reporting for l1tf
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 032/107] x86/speculation/l1tf: Make sure the first page is always reserved Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 034/107] x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings Greg Kroah-Hartman
` (73 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner,
Josh Poimboeuf, Dave Hansen, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit 17dbca119312b4e8173d4e25ff64262119fcef38 upstream
L1TF core kernel workarounds are cheap and normally always enabled, However
they still should be reported in sysfs if the system is vulnerable or
mitigated. Add the necessary CPU feature/bug bits.
- Extend the existing checks for Meltdowns to determine if the system is
vulnerable. All CPUs which are not vulnerable to Meltdown are also not
vulnerable to L1TF
- Check for 32bit non PAE and emit a warning as there is no practical way
for mitigation due to the limited physical address bits
- If the system has more than MAX_PA/2 physical memory the invert page
workarounds don't protect the system against the L1TF attack anymore,
because an inverted physical address will also point to valid
memory. Print a warning in this case and report that the system is
vulnerable.
Add a function which returns the PFN limit for the L1TF mitigation, which
will be used in follow up patches for sanity and range checks.
[ tglx: Renamed the CPU feature bit to L1TF_PTEINV ]
[ dwmw2: Backport to 4.9 (cpufeatures.h, E820) ]
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/cpufeatures.h | 3 +-
arch/x86/include/asm/processor.h | 5 ++++
arch/x86/kernel/cpu/bugs.c | 40 +++++++++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/common.c | 20 ++++++++++++++++++
drivers/base/cpu.c | 8 +++++++
include/linux/cpu.h | 2 +
6 files changed, 77 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -213,7 +213,7 @@
#define X86_FEATURE_IBPB ( 7*32+26) /* Indirect Branch Prediction Barrier */
#define X86_FEATURE_STIBP ( 7*32+27) /* Single Thread Indirect Branch Predictors */
#define X86_FEATURE_ZEN ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */
-
+#define X86_FEATURE_L1TF_PTEINV ( 7*32+29) /* "" L1TF workaround PTE inversion */
/* Virtualization flags: Linux defined, word 8 */
#define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */
@@ -349,5 +349,6 @@
#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */
#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */
#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */
+#define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
#endif /* _ASM_X86_CPUFEATURES_H */
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -173,6 +173,11 @@ extern const struct seq_operations cpuin
extern void cpu_detect(struct cpuinfo_x86 *c);
+static inline unsigned long l1tf_pfn_limit(void)
+{
+ return BIT(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT) - 1;
+}
+
extern void early_cpu_init(void);
extern void identify_boot_cpu(void);
extern void identify_secondary_cpu(struct cpuinfo_x86 *);
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -26,9 +26,11 @@
#include <asm/pgtable.h>
#include <asm/cacheflush.h>
#include <asm/intel-family.h>
+#include <asm/e820.h>
static void __init spectre_v2_select_mitigation(void);
static void __init ssb_select_mitigation(void);
+static void __init l1tf_select_mitigation(void);
/*
* Our boot-time value of the SPEC_CTRL MSR. We read it once so that any
@@ -80,6 +82,8 @@ void __init check_bugs(void)
*/
ssb_select_mitigation();
+ l1tf_select_mitigation();
+
#ifdef CONFIG_X86_32
/*
* Check whether we are able to run this kernel safely on SMP.
@@ -204,6 +208,32 @@ static void x86_amd_ssb_disable(void)
wrmsrl(MSR_AMD64_LS_CFG, msrval);
}
+static void __init l1tf_select_mitigation(void)
+{
+ u64 half_pa;
+
+ if (!boot_cpu_has_bug(X86_BUG_L1TF))
+ return;
+
+#if CONFIG_PGTABLE_LEVELS == 2
+ pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n");
+ return;
+#endif
+
+ /*
+ * This is extremely unlikely to happen because almost all
+ * systems have far more MAX_PA/2 than RAM can be fit into
+ * DIMM slots.
+ */
+ half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
+ if (e820_any_mapped(half_pa, ULLONG_MAX - half_pa, E820_RAM)) {
+ pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
+ return;
+ }
+
+ setup_force_cpu_cap(X86_FEATURE_L1TF_PTEINV);
+}
+
#ifdef RETPOLINE
static bool spectre_v2_bad_module;
@@ -656,6 +686,11 @@ static ssize_t cpu_show_common(struct de
case X86_BUG_SPEC_STORE_BYPASS:
return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+ case X86_BUG_L1TF:
+ if (boot_cpu_has(X86_FEATURE_L1TF_PTEINV))
+ return sprintf(buf, "Mitigation: Page Table Inversion\n");
+ break;
+
default:
break;
}
@@ -682,4 +717,9 @@ ssize_t cpu_show_spec_store_bypass(struc
{
return cpu_show_common(dev, attr, buf, X86_BUG_SPEC_STORE_BYPASS);
}
+
+ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf)
+{
+ return cpu_show_common(dev, attr, buf, X86_BUG_L1TF);
+}
#endif
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -925,6 +925,21 @@ static const __initconst struct x86_cpu_
{}
};
+static const __initconst struct x86_cpu_id cpu_no_l1tf[] = {
+ /* in addition to cpu_no_speculation */
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT2 },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MERRIFIELD },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MOOREFIELD },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_DENVERTON },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GEMINI_LAKE },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM },
+ {}
+};
+
static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
{
u64 ia32_cap = 0;
@@ -950,6 +965,11 @@ static void __init cpu_set_bug_bits(stru
return;
setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
+
+ if (x86_match_cpu(cpu_no_l1tf))
+ return;
+
+ setup_force_cpu_bug(X86_BUG_L1TF);
}
/*
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -525,16 +525,24 @@ ssize_t __weak cpu_show_spec_store_bypas
return sprintf(buf, "Not affected\n");
}
+ssize_t __weak cpu_show_l1tf(struct device *dev,
+ struct device_attribute *attr, char *buf)
+{
+ return sprintf(buf, "Not affected\n");
+}
+
static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL);
+static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL);
static struct attribute *cpu_root_vulnerabilities_attrs[] = {
&dev_attr_meltdown.attr,
&dev_attr_spectre_v1.attr,
&dev_attr_spectre_v2.attr,
&dev_attr_spec_store_bypass.attr,
+ &dev_attr_l1tf.attr,
NULL
};
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -52,6 +52,8 @@ extern ssize_t cpu_show_spectre_v2(struc
struct device_attribute *attr, char *buf);
extern ssize_t cpu_show_spec_store_bypass(struct device *dev,
struct device_attribute *attr, char *buf);
+extern ssize_t cpu_show_l1tf(struct device *dev,
+ struct device_attribute *attr, char *buf);
extern __printf(4, 5)
struct device *cpu_device_create(struct device *parent, void *drvdata,
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 034/107] x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 033/107] x86/speculation/l1tf: Add sysfs reporting for l1tf Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 035/107] x86/speculation/l1tf: Limit swap file size to MAX_PA/2 Greg Kroah-Hartman
` (72 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner,
Josh Poimboeuf, Dave Hansen, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit 42e4089c7890725fcd329999252dc489b72f2921 upstream
For L1TF PROT_NONE mappings are protected by inverting the PFN in the page
table entry. This sets the high bits in the CPU's address space, thus
making sure to point to not point an unmapped entry to valid cached memory.
Some server system BIOSes put the MMIO mappings high up in the physical
address space. If such an high mapping was mapped to unprivileged users
they could attack low memory by setting such a mapping to PROT_NONE. This
could happen through a special device driver which is not access
protected. Normal /dev/mem is of course access protected.
To avoid this forbid PROT_NONE mappings or mprotect for high MMIO mappings.
Valid page mappings are allowed because the system is then unsafe anyways.
It's not expected that users commonly use PROT_NONE on MMIO. But to
minimize any impact this is only enforced if the mapping actually refers to
a high MMIO address (defined as the MAX_PA-1 bit being set), and also skip
the check for root.
For mmaps this is straight forward and can be handled in vm_insert_pfn and
in remap_pfn_range().
For mprotect it's a bit trickier. At the point where the actual PTEs are
accessed a lot of state has been changed and it would be difficult to undo
on an error. Since this is a uncommon case use a separate early page talk
walk pass for MMIO PROT_NONE mappings that checks for this condition
early. For non MMIO and non PROT_NONE there are no changes.
[dwmw2: Backport to 4.9]
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable.h | 9 +++++++
arch/x86/mm/mmap.c | 21 +++++++++++++++++
include/asm-generic/pgtable.h | 12 ++++++++++
mm/memory.c | 29 ++++++++++++++++++------
mm/mprotect.c | 49 +++++++++++++++++++++++++++++++++++++++++
5 files changed, 113 insertions(+), 7 deletions(-)
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -1026,6 +1026,15 @@ static inline u16 pte_flags_pkey(unsigne
#endif
}
+
+#define __HAVE_ARCH_PFN_MODIFY_ALLOWED 1
+extern bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot);
+
+static inline bool arch_has_pfn_modify_check(void)
+{
+ return boot_cpu_has_bug(X86_BUG_L1TF);
+}
+
#include <asm-generic/pgtable.h>
#endif /* __ASSEMBLY__ */
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -121,3 +121,24 @@ const char *arch_vma_name(struct vm_area
return "[mpx]";
return NULL;
}
+
+/*
+ * Only allow root to set high MMIO mappings to PROT_NONE.
+ * This prevents an unpriv. user to set them to PROT_NONE and invert
+ * them, then pointing to valid memory for L1TF speculation.
+ *
+ * Note: for locked down kernels may want to disable the root override.
+ */
+bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot)
+{
+ if (!boot_cpu_has_bug(X86_BUG_L1TF))
+ return true;
+ if (!__pte_needs_invert(pgprot_val(prot)))
+ return true;
+ /* If it's real memory always allow */
+ if (pfn_valid(pfn))
+ return true;
+ if (pfn > l1tf_pfn_limit() && !capable(CAP_SYS_ADMIN))
+ return false;
+ return true;
+}
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -842,4 +842,16 @@ int phys_mem_access_prot_allowed(struct
#endif
#endif
+#ifndef __HAVE_ARCH_PFN_MODIFY_ALLOWED
+static inline bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot)
+{
+ return true;
+}
+
+static inline bool arch_has_pfn_modify_check(void)
+{
+ return false;
+}
+#endif
+
#endif /* _ASM_GENERIC_PGTABLE_H */
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1641,6 +1641,9 @@ int vm_insert_pfn_prot(struct vm_area_st
if (track_pfn_insert(vma, &pgprot, __pfn_to_pfn_t(pfn, PFN_DEV)))
return -EINVAL;
+ if (!pfn_modify_allowed(pfn, pgprot))
+ return -EACCES;
+
ret = insert_pfn(vma, addr, __pfn_to_pfn_t(pfn, PFN_DEV), pgprot);
return ret;
@@ -1659,6 +1662,9 @@ int vm_insert_mixed(struct vm_area_struc
if (track_pfn_insert(vma, &pgprot, pfn))
return -EINVAL;
+ if (!pfn_modify_allowed(pfn_t_to_pfn(pfn), pgprot))
+ return -EACCES;
+
/*
* If we don't have pte special, then we have to use the pfn_valid()
* based VM_MIXEDMAP scheme (see vm_normal_page), and thus we *must*
@@ -1692,6 +1698,7 @@ static int remap_pte_range(struct mm_str
{
pte_t *pte;
spinlock_t *ptl;
+ int err = 0;
pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
if (!pte)
@@ -1699,12 +1706,16 @@ static int remap_pte_range(struct mm_str
arch_enter_lazy_mmu_mode();
do {
BUG_ON(!pte_none(*pte));
+ if (!pfn_modify_allowed(pfn, prot)) {
+ err = -EACCES;
+ break;
+ }
set_pte_at(mm, addr, pte, pte_mkspecial(pfn_pte(pfn, prot)));
pfn++;
} while (pte++, addr += PAGE_SIZE, addr != end);
arch_leave_lazy_mmu_mode();
pte_unmap_unlock(pte - 1, ptl);
- return 0;
+ return err;
}
static inline int remap_pmd_range(struct mm_struct *mm, pud_t *pud,
@@ -1713,6 +1724,7 @@ static inline int remap_pmd_range(struct
{
pmd_t *pmd;
unsigned long next;
+ int err;
pfn -= addr >> PAGE_SHIFT;
pmd = pmd_alloc(mm, pud, addr);
@@ -1721,9 +1733,10 @@ static inline int remap_pmd_range(struct
VM_BUG_ON(pmd_trans_huge(*pmd));
do {
next = pmd_addr_end(addr, end);
- if (remap_pte_range(mm, pmd, addr, next,
- pfn + (addr >> PAGE_SHIFT), prot))
- return -ENOMEM;
+ err = remap_pte_range(mm, pmd, addr, next,
+ pfn + (addr >> PAGE_SHIFT), prot);
+ if (err)
+ return err;
} while (pmd++, addr = next, addr != end);
return 0;
}
@@ -1734,6 +1747,7 @@ static inline int remap_pud_range(struct
{
pud_t *pud;
unsigned long next;
+ int err;
pfn -= addr >> PAGE_SHIFT;
pud = pud_alloc(mm, pgd, addr);
@@ -1741,9 +1755,10 @@ static inline int remap_pud_range(struct
return -ENOMEM;
do {
next = pud_addr_end(addr, end);
- if (remap_pmd_range(mm, pud, addr, next,
- pfn + (addr >> PAGE_SHIFT), prot))
- return -ENOMEM;
+ err = remap_pmd_range(mm, pud, addr, next,
+ pfn + (addr >> PAGE_SHIFT), prot);
+ if (err)
+ return err;
} while (pud++, addr = next, addr != end);
return 0;
}
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -260,6 +260,42 @@ unsigned long change_protection(struct v
return pages;
}
+static int prot_none_pte_entry(pte_t *pte, unsigned long addr,
+ unsigned long next, struct mm_walk *walk)
+{
+ return pfn_modify_allowed(pte_pfn(*pte), *(pgprot_t *)(walk->private)) ?
+ 0 : -EACCES;
+}
+
+static int prot_none_hugetlb_entry(pte_t *pte, unsigned long hmask,
+ unsigned long addr, unsigned long next,
+ struct mm_walk *walk)
+{
+ return pfn_modify_allowed(pte_pfn(*pte), *(pgprot_t *)(walk->private)) ?
+ 0 : -EACCES;
+}
+
+static int prot_none_test(unsigned long addr, unsigned long next,
+ struct mm_walk *walk)
+{
+ return 0;
+}
+
+static int prot_none_walk(struct vm_area_struct *vma, unsigned long start,
+ unsigned long end, unsigned long newflags)
+{
+ pgprot_t new_pgprot = vm_get_page_prot(newflags);
+ struct mm_walk prot_none_walk = {
+ .pte_entry = prot_none_pte_entry,
+ .hugetlb_entry = prot_none_hugetlb_entry,
+ .test_walk = prot_none_test,
+ .mm = current->mm,
+ .private = &new_pgprot,
+ };
+
+ return walk_page_range(start, end, &prot_none_walk);
+}
+
int
mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
unsigned long start, unsigned long end, unsigned long newflags)
@@ -278,6 +314,19 @@ mprotect_fixup(struct vm_area_struct *vm
}
/*
+ * Do PROT_NONE PFN permission checks here when we can still
+ * bail out without undoing a lot of state. This is a rather
+ * uncommon case, so doesn't need to be very optimized.
+ */
+ if (arch_has_pfn_modify_check() &&
+ (vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) &&
+ (newflags & (VM_READ|VM_WRITE|VM_EXEC)) == 0) {
+ error = prot_none_walk(vma, start, end, newflags);
+ if (error)
+ return error;
+ }
+
+ /*
* If we make a private mapping writable we increase our commit;
* but (without finer accounting) cannot reduce our commit if we
* make it unwritable again. hugetlb mapping were accounted for
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 035/107] x86/speculation/l1tf: Limit swap file size to MAX_PA/2
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 034/107] x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:16 ` [PATCH 4.9 036/107] x86/bugs: Move the l1tf function and define pr_fmt properly Greg Kroah-Hartman
` (71 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner,
Josh Poimboeuf, Michal Hocko, Dave Hansen, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit 377eeaa8e11fe815b1d07c81c4a0e2843a8c15eb upstream
For the L1TF workaround its necessary to limit the swap file size to below
MAX_PA/2, so that the higher bits of the swap offset inverted never point
to valid memory.
Add a mechanism for the architecture to override the swap file size check
in swapfile.c and add a x86 specific max swapfile check function that
enforces that limit.
The check is only enabled if the CPU is vulnerable to L1TF.
In VMs with 42bit MAX_PA the typical limit is 2TB now, on a native system
with 46bit PA it is 32TB. The limit is only per individual swap file, so
it's always possible to exceed these limits with multiple swap files or
partitions.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/init.c | 15 +++++++++++++++
include/linux/swapfile.h | 2 ++
mm/swapfile.c | 46 ++++++++++++++++++++++++++++++----------------
3 files changed, 47 insertions(+), 16 deletions(-)
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -4,6 +4,8 @@
#include <linux/swap.h>
#include <linux/memblock.h>
#include <linux/bootmem.h> /* for max_low_pfn */
+#include <linux/swapfile.h>
+#include <linux/swapops.h>
#include <asm/cacheflush.h>
#include <asm/e820.h>
@@ -780,3 +782,16 @@ void update_cache_mode_entry(unsigned en
__cachemode2pte_tbl[cache] = __cm_idx2pte(entry);
__pte2cachemode_tbl[entry] = cache;
}
+
+unsigned long max_swapfile_size(void)
+{
+ unsigned long pages;
+
+ pages = generic_max_swapfile_size();
+
+ if (boot_cpu_has_bug(X86_BUG_L1TF)) {
+ /* Limit the swap file size to MAX_PA/2 for L1TF workaround */
+ pages = min_t(unsigned long, l1tf_pfn_limit() + 1, pages);
+ }
+ return pages;
+}
--- a/include/linux/swapfile.h
+++ b/include/linux/swapfile.h
@@ -9,5 +9,7 @@ extern spinlock_t swap_lock;
extern struct plist_head swap_active_head;
extern struct swap_info_struct *swap_info[];
extern int try_to_unuse(unsigned int, bool, unsigned long);
+extern unsigned long generic_max_swapfile_size(void);
+extern unsigned long max_swapfile_size(void);
#endif /* _LINUX_SWAPFILE_H */
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2219,6 +2219,35 @@ static int claim_swapfile(struct swap_in
return 0;
}
+
+/*
+ * Find out how many pages are allowed for a single swap device. There
+ * are two limiting factors:
+ * 1) the number of bits for the swap offset in the swp_entry_t type, and
+ * 2) the number of bits in the swap pte, as defined by the different
+ * architectures.
+ *
+ * In order to find the largest possible bit mask, a swap entry with
+ * swap type 0 and swap offset ~0UL is created, encoded to a swap pte,
+ * decoded to a swp_entry_t again, and finally the swap offset is
+ * extracted.
+ *
+ * This will mask all the bits from the initial ~0UL mask that can't
+ * be encoded in either the swp_entry_t or the architecture definition
+ * of a swap pte.
+ */
+unsigned long generic_max_swapfile_size(void)
+{
+ return swp_offset(pte_to_swp_entry(
+ swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1;
+}
+
+/* Can be overridden by an architecture for additional checks. */
+__weak unsigned long max_swapfile_size(void)
+{
+ return generic_max_swapfile_size();
+}
+
static unsigned long read_swap_header(struct swap_info_struct *p,
union swap_header *swap_header,
struct inode *inode)
@@ -2254,22 +2283,7 @@ static unsigned long read_swap_header(st
p->cluster_next = 1;
p->cluster_nr = 0;
- /*
- * Find out how many pages are allowed for a single swap
- * device. There are two limiting factors: 1) the number
- * of bits for the swap offset in the swp_entry_t type, and
- * 2) the number of bits in the swap pte as defined by the
- * different architectures. In order to find the
- * largest possible bit mask, a swap entry with swap type 0
- * and swap offset ~0UL is created, encoded to a swap pte,
- * decoded to a swp_entry_t again, and finally the swap
- * offset is extracted. This will mask all the bits from
- * the initial ~0UL mask that can't be encoded in either
- * the swp_entry_t or the architecture definition of a
- * swap pte.
- */
- maxpages = swp_offset(pte_to_swp_entry(
- swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1;
+ maxpages = max_swapfile_size();
last_page = swap_header->info.last_page;
if (!last_page) {
pr_warn("Empty swap-file\n");
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 036/107] x86/bugs: Move the l1tf function and define pr_fmt properly
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 035/107] x86/speculation/l1tf: Limit swap file size to MAX_PA/2 Greg Kroah-Hartman
@ 2018-08-14 17:16 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 037/107] x86/smp: Provide topology_is_primary_thread() Greg Kroah-Hartman
` (70 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 56563f53d3066afa9e63d6c997bf67e76a8b05c0 upstream
The pr_warn in l1tf_select_mitigation would have used the prior pr_fmt
which was defined as "Spectre V2 : ".
Move the function to be past SSBD and also define the pr_fmt.
Fixes: 17dbca119312 ("x86/speculation/l1tf: Add sysfs reporting for l1tf")
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/bugs.c | 55 +++++++++++++++++++++++----------------------
1 file changed, 29 insertions(+), 26 deletions(-)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -208,32 +208,6 @@ static void x86_amd_ssb_disable(void)
wrmsrl(MSR_AMD64_LS_CFG, msrval);
}
-static void __init l1tf_select_mitigation(void)
-{
- u64 half_pa;
-
- if (!boot_cpu_has_bug(X86_BUG_L1TF))
- return;
-
-#if CONFIG_PGTABLE_LEVELS == 2
- pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n");
- return;
-#endif
-
- /*
- * This is extremely unlikely to happen because almost all
- * systems have far more MAX_PA/2 than RAM can be fit into
- * DIMM slots.
- */
- half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
- if (e820_any_mapped(half_pa, ULLONG_MAX - half_pa, E820_RAM)) {
- pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
- return;
- }
-
- setup_force_cpu_cap(X86_FEATURE_L1TF_PTEINV);
-}
-
#ifdef RETPOLINE
static bool spectre_v2_bad_module;
@@ -659,6 +633,35 @@ void x86_spec_ctrl_setup_ap(void)
x86_amd_ssb_disable();
}
+#undef pr_fmt
+#define pr_fmt(fmt) "L1TF: " fmt
+static void __init l1tf_select_mitigation(void)
+{
+ u64 half_pa;
+
+ if (!boot_cpu_has_bug(X86_BUG_L1TF))
+ return;
+
+#if CONFIG_PGTABLE_LEVELS == 2
+ pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n");
+ return;
+#endif
+
+ /*
+ * This is extremely unlikely to happen because almost all
+ * systems have far more MAX_PA/2 than RAM can be fit into
+ * DIMM slots.
+ */
+ half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
+ if (e820_any_mapped(half_pa, ULLONG_MAX - half_pa, E820_RAM)) {
+ pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
+ return;
+ }
+
+ setup_force_cpu_cap(X86_FEATURE_L1TF_PTEINV);
+}
+#undef pr_fmt
+
#ifdef CONFIG_SYSFS
static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 037/107] x86/smp: Provide topology_is_primary_thread()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2018-08-14 17:16 ` [PATCH 4.9 036/107] x86/bugs: Move the l1tf function and define pr_fmt properly Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 038/107] x86/topology: Provide topology_smt_supported() Greg Kroah-Hartman
` (69 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Konrad Rzeszutek Wilk, Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 6a4d2657e048f096c7ffcad254010bd94891c8c0 upstream
If the CPU is supporting SMT then the primary thread can be found by
checking the lower APIC ID bits for zero. smp_num_siblings is used to build
the mask for the APIC ID bits which need to be taken into account.
This uses the MPTABLE or ACPI/MADT supplied APIC ID, which can be different
than the initial APIC ID in CPUID. But according to AMD the lower bits have
to be consistent. Intel gave a tentative confirmation as well.
Preparatory patch to support disabling SMT at boot/runtime.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/apic.h | 7 +++++++
arch/x86/include/asm/topology.h | 4 +++-
arch/x86/kernel/apic/apic.c | 15 +++++++++++++++
arch/x86/kernel/smpboot.c | 9 +++++++++
4 files changed, 34 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -633,6 +633,13 @@ extern int default_check_phys_apicid_pre
#endif
#endif /* CONFIG_X86_LOCAL_APIC */
+
+#ifdef CONFIG_SMP
+bool apic_id_is_primary_thread(unsigned int id);
+#else
+static inline bool apic_id_is_primary_thread(unsigned int id) { return false; }
+#endif
+
extern void irq_enter(void);
extern void irq_exit(void);
--- a/arch/x86/include/asm/topology.h
+++ b/arch/x86/include/asm/topology.h
@@ -129,13 +129,15 @@ static inline int topology_max_smt_threa
}
int topology_update_package_map(unsigned int apicid, unsigned int cpu);
-extern int topology_phys_to_logical_pkg(unsigned int pkg);
+int topology_phys_to_logical_pkg(unsigned int pkg);
+bool topology_is_primary_thread(unsigned int cpu);
#else
#define topology_max_packages() (1)
static inline int
topology_update_package_map(unsigned int apicid, unsigned int cpu) { return 0; }
static inline int topology_phys_to_logical_pkg(unsigned int pkg) { return 0; }
static inline int topology_max_smt_threads(void) { return 1; }
+static inline bool topology_is_primary_thread(unsigned int cpu) { return true; }
#endif
static inline void arch_fix_phys_package_id(int num, u32 slot)
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -2041,6 +2041,21 @@ static int cpuid_to_apicid[] = {
[0 ... NR_CPUS - 1] = -1,
};
+/**
+ * apic_id_is_primary_thread - Check whether APIC ID belongs to a primary thread
+ * @id: APIC ID to check
+ */
+bool apic_id_is_primary_thread(unsigned int apicid)
+{
+ u32 mask;
+
+ if (smp_num_siblings == 1)
+ return true;
+ /* Isolate the SMT bit(s) in the APICID and check for 0 */
+ mask = (1U << (fls(smp_num_siblings) - 1)) - 1;
+ return !(apicid & mask);
+}
+
/*
* Should use this API to allocate logical CPU IDs to keep nr_logical_cpuids
* and cpuid_to_apicid[] synchronized.
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -296,6 +296,15 @@ found:
}
/**
+ * topology_is_primary_thread - Check whether CPU is the primary SMT thread
+ * @cpu: CPU to check
+ */
+bool topology_is_primary_thread(unsigned int cpu)
+{
+ return apic_id_is_primary_thread(per_cpu(x86_cpu_to_apicid, cpu));
+}
+
+/**
* topology_phys_to_logical_pkg - Map a physical package id to a logical
*
* Returns logical package id or -1 if not found
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 038/107] x86/topology: Provide topology_smt_supported()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 037/107] x86/smp: Provide topology_is_primary_thread() Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 039/107] cpu/hotplug: Make bringup/teardown of smp threads symmetric Greg Kroah-Hartman
` (68 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Hansen, Thomas Gleixner,
Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit f048c399e0f7490ab7296bc2c255d37eb14a9675 upstream
Provide information whether SMT is supoorted by the CPUs. Preparatory patch
for SMT control mechanism.
Suggested-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/topology.h | 2 ++
arch/x86/kernel/smpboot.c | 8 ++++++++
2 files changed, 10 insertions(+)
--- a/arch/x86/include/asm/topology.h
+++ b/arch/x86/include/asm/topology.h
@@ -131,6 +131,7 @@ static inline int topology_max_smt_threa
int topology_update_package_map(unsigned int apicid, unsigned int cpu);
int topology_phys_to_logical_pkg(unsigned int pkg);
bool topology_is_primary_thread(unsigned int cpu);
+bool topology_smt_supported(void);
#else
#define topology_max_packages() (1)
static inline int
@@ -138,6 +139,7 @@ topology_update_package_map(unsigned int
static inline int topology_phys_to_logical_pkg(unsigned int pkg) { return 0; }
static inline int topology_max_smt_threads(void) { return 1; }
static inline bool topology_is_primary_thread(unsigned int cpu) { return true; }
+static inline bool topology_smt_supported(void) { return false; }
#endif
static inline void arch_fix_phys_package_id(int num, u32 slot)
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -305,6 +305,14 @@ bool topology_is_primary_thread(unsigned
}
/**
+ * topology_smt_supported - Check whether SMT is supported by the CPUs
+ */
+bool topology_smt_supported(void)
+{
+ return smp_num_siblings > 1;
+}
+
+/**
* topology_phys_to_logical_pkg - Map a physical package id to a logical
*
* Returns logical package id or -1 if not found
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 039/107] cpu/hotplug: Make bringup/teardown of smp threads symmetric
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 038/107] x86/topology: Provide topology_smt_supported() Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 040/107] cpu/hotplug: Split do_cpu_down() Greg Kroah-Hartman
` (67 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Konrad Rzeszutek Wilk, Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit c4de65696d865c225fda3b9913b31284ea65ea96 upstream
The asymmetry caused a warning to trigger if the bootup was stopped in state
CPUHP_AP_ONLINE_IDLE. The warning no longer triggers as kthread_park() can
now be invoked on already or still parked threads. But there is still no
reason to have this be asymmetric.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cpu.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -817,7 +817,6 @@ static int takedown_cpu(unsigned int cpu
/* Park the smpboot threads */
kthread_park(per_cpu_ptr(&cpuhp_state, cpu)->thread);
- smpboot_park_threads(cpu);
/*
* Prevent irq alloc/free while the dying cpu reorganizes the
@@ -1389,7 +1388,7 @@ static struct cpuhp_step cpuhp_ap_states
[CPUHP_AP_SMPBOOT_THREADS] = {
.name = "smpboot/threads:online",
.startup.single = smpboot_unpark_threads,
- .teardown.single = NULL,
+ .teardown.single = smpboot_park_threads,
},
[CPUHP_AP_PERF_ONLINE] = {
.name = "perf:online",
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 040/107] cpu/hotplug: Split do_cpu_down()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 039/107] cpu/hotplug: Make bringup/teardown of smp threads symmetric Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 041/107] cpu/hotplug: Provide knobs to control SMT Greg Kroah-Hartman
` (66 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Konrad Rzeszutek Wilk, Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit cc1fe215e1efa406b03aa4389e6269b61342dec5 upstream
Split out the inner workings of do_cpu_down() to allow reuse of that
function for the upcoming SMT disabling mechanism.
No functional change.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cpu.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -955,20 +955,19 @@ out:
return ret;
}
+static int cpu_down_maps_locked(unsigned int cpu, enum cpuhp_state target)
+{
+ if (cpu_hotplug_disabled)
+ return -EBUSY;
+ return _cpu_down(cpu, 0, target);
+}
+
static int do_cpu_down(unsigned int cpu, enum cpuhp_state target)
{
int err;
cpu_maps_update_begin();
-
- if (cpu_hotplug_disabled) {
- err = -EBUSY;
- goto out;
- }
-
- err = _cpu_down(cpu, 0, target);
-
-out:
+ err = cpu_down_maps_locked(cpu, target);
cpu_maps_update_done();
return err;
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 041/107] cpu/hotplug: Provide knobs to control SMT
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 040/107] cpu/hotplug: Split do_cpu_down() Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 042/107] x86/cpu: Remove the pointless CPU printout Greg Kroah-Hartman
` (65 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Konrad Rzeszutek Wilk, Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 05736e4ac13c08a4a9b1ef2de26dd31a32cbee57 upstream
Provide a command line and a sysfs knob to control SMT.
The command line options are:
'nosmt': Enumerate secondary threads, but do not online them
'nosmt=force': Ignore secondary threads completely during enumeration
via MP table and ACPI/MADT.
The sysfs control file has the following states (read/write):
'on': SMT is enabled. Secondary threads can be freely onlined
'off': SMT is disabled. Secondary threads, even if enumerated
cannot be onlined
'forceoff': SMT is permanentely disabled. Writes to the control
file are rejected.
'notsupported': SMT is not supported by the CPU
The command line option 'nosmt' sets the sysfs control to 'off'. This
can be changed to 'on' to reenable SMT during runtime.
The command line option 'nosmt=force' sets the sysfs control to
'forceoff'. This cannot be changed during runtime.
When SMT is 'on' and the control file is changed to 'off' then all online
secondary threads are offlined and attempts to online a secondary thread
later on are rejected.
When SMT is 'off' and the control file is changed to 'on' then secondary
threads can be onlined again. The 'off' -> 'on' transition does not
automatically online the secondary threads.
When the control file is set to 'forceoff', the behaviour is the same as
setting it to 'off', but the operation is irreversible and later writes to
the control file are rejected.
When the control status is 'notsupported' then writes to the control file
are rejected.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/sysfs-devices-system-cpu | 20 ++
Documentation/kernel-parameters.txt | 8
arch/Kconfig | 3
arch/x86/Kconfig | 1
include/linux/cpu.h | 13 +
kernel/cpu.c | 170 +++++++++++++++++++++
6 files changed, 215 insertions(+)
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -367,3 +367,23 @@ Description: Information about CPU vulne
"Not affected" CPU is not affected by the vulnerability
"Vulnerable" CPU is affected and no mitigation in effect
"Mitigation: $M" CPU is affected and mitigation $M is in effect
+
+What: /sys/devices/system/cpu/smt
+ /sys/devices/system/cpu/smt/active
+ /sys/devices/system/cpu/smt/control
+Date: June 2018
+Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
+Description: Control Symetric Multi Threading (SMT)
+
+ active: Tells whether SMT is active (enabled and siblings online)
+
+ control: Read/write interface to control SMT. Possible
+ values:
+
+ "on" SMT is enabled
+ "off" SMT is disabled
+ "forceoff" SMT is force disabled. Cannot be changed.
+ "notsupported" SMT is not supported by the CPU
+
+ If control status is "forceoff" or "notsupported" writes
+ are rejected.
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2694,6 +2694,14 @@ bytes respectively. Such letter suffixes
nosmt [KNL,S390] Disable symmetric multithreading (SMT).
Equivalent to smt=1.
+ [KNL,x86] Disable symmetric multithreading (SMT).
+ nosmt=force: Force disable SMT, similar to disabling
+ it in the BIOS except that some of the
+ resource partitioning effects which are
+ caused by having SMT enabled in the BIOS
+ cannot be undone. Depending on the CPU
+ type this might have a performance impact.
+
nospectre_v2 [X86] Disable all mitigations for the Spectre variant 2
(indirect branch prediction) vulnerability. System may
allow data leaks with this option, which is equivalent
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -5,6 +5,9 @@
config KEXEC_CORE
bool
+config HOTPLUG_SMT
+ bool
+
config OPROFILE
tristate "OProfile system profiling"
depends on PROFILING
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -147,6 +147,7 @@ config X86
select HAVE_UID16 if X86_32 || IA32_EMULATION
select HAVE_UNSTABLE_SCHED_CLOCK
select HAVE_USER_RETURN_NOTIFIER
+ select HOTPLUG_SMT if SMP
select IRQ_FORCED_THREADING
select MODULES_USE_ELF_RELA if X86_64
select MODULES_USE_ELF_REL if X86_32
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -257,4 +257,17 @@ void cpuhp_report_idle_dead(void);
static inline void cpuhp_report_idle_dead(void) { }
#endif /* #ifdef CONFIG_HOTPLUG_CPU */
+enum cpuhp_smt_control {
+ CPU_SMT_ENABLED,
+ CPU_SMT_DISABLED,
+ CPU_SMT_FORCE_DISABLED,
+ CPU_SMT_NOT_SUPPORTED,
+};
+
+#if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
+extern enum cpuhp_smt_control cpu_smt_control;
+#else
+# define cpu_smt_control (CPU_SMT_ENABLED)
+#endif
+
#endif /* _LINUX_CPU_H_ */
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -978,6 +978,29 @@ int cpu_down(unsigned int cpu)
EXPORT_SYMBOL(cpu_down);
#endif /*CONFIG_HOTPLUG_CPU*/
+#ifdef CONFIG_HOTPLUG_SMT
+enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
+
+static int __init smt_cmdline_disable(char *str)
+{
+ cpu_smt_control = CPU_SMT_DISABLED;
+ if (str && !strcmp(str, "force")) {
+ pr_info("SMT: Force disabled\n");
+ cpu_smt_control = CPU_SMT_FORCE_DISABLED;
+ }
+ return 0;
+}
+early_param("nosmt", smt_cmdline_disable);
+
+static inline bool cpu_smt_allowed(unsigned int cpu)
+{
+ return cpu_smt_control == CPU_SMT_ENABLED ||
+ topology_is_primary_thread(cpu);
+}
+#else
+static inline bool cpu_smt_allowed(unsigned int cpu) { return true; }
+#endif
+
/**
* notify_cpu_starting(cpu) - Invoke the callbacks on the starting CPU
* @cpu: cpu that just started
@@ -1096,6 +1119,10 @@ static int do_cpu_up(unsigned int cpu, e
err = -EBUSY;
goto out;
}
+ if (!cpu_smt_allowed(cpu)) {
+ err = -EPERM;
+ goto out;
+ }
err = _cpu_up(cpu, 0, target);
out:
@@ -1842,10 +1869,153 @@ static struct attribute_group cpuhp_cpu_
NULL
};
+#ifdef CONFIG_HOTPLUG_SMT
+
+static const char *smt_states[] = {
+ [CPU_SMT_ENABLED] = "on",
+ [CPU_SMT_DISABLED] = "off",
+ [CPU_SMT_FORCE_DISABLED] = "forceoff",
+ [CPU_SMT_NOT_SUPPORTED] = "notsupported",
+};
+
+static ssize_t
+show_smt_control(struct device *dev, struct device_attribute *attr, char *buf)
+{
+ return snprintf(buf, PAGE_SIZE - 2, "%s\n", smt_states[cpu_smt_control]);
+}
+
+static void cpuhp_offline_cpu_device(unsigned int cpu)
+{
+ struct device *dev = get_cpu_device(cpu);
+
+ dev->offline = true;
+ /* Tell user space about the state change */
+ kobject_uevent(&dev->kobj, KOBJ_OFFLINE);
+}
+
+static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+{
+ int cpu, ret = 0;
+
+ cpu_maps_update_begin();
+ for_each_online_cpu(cpu) {
+ if (topology_is_primary_thread(cpu))
+ continue;
+ ret = cpu_down_maps_locked(cpu, CPUHP_OFFLINE);
+ if (ret)
+ break;
+ /*
+ * As this needs to hold the cpu maps lock it's impossible
+ * to call device_offline() because that ends up calling
+ * cpu_down() which takes cpu maps lock. cpu maps lock
+ * needs to be held as this might race against in kernel
+ * abusers of the hotplug machinery (thermal management).
+ *
+ * So nothing would update device:offline state. That would
+ * leave the sysfs entry stale and prevent onlining after
+ * smt control has been changed to 'off' again. This is
+ * called under the sysfs hotplug lock, so it is properly
+ * serialized against the regular offline usage.
+ */
+ cpuhp_offline_cpu_device(cpu);
+ }
+ if (!ret)
+ cpu_smt_control = ctrlval;
+ cpu_maps_update_done();
+ return ret;
+}
+
+static void cpuhp_smt_enable(void)
+{
+ cpu_maps_update_begin();
+ cpu_smt_control = CPU_SMT_ENABLED;
+ cpu_maps_update_done();
+}
+
+static ssize_t
+store_smt_control(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+{
+ int ctrlval, ret;
+
+ if (sysfs_streq(buf, "on"))
+ ctrlval = CPU_SMT_ENABLED;
+ else if (sysfs_streq(buf, "off"))
+ ctrlval = CPU_SMT_DISABLED;
+ else if (sysfs_streq(buf, "forceoff"))
+ ctrlval = CPU_SMT_FORCE_DISABLED;
+ else
+ return -EINVAL;
+
+ if (cpu_smt_control == CPU_SMT_FORCE_DISABLED)
+ return -EPERM;
+
+ if (cpu_smt_control == CPU_SMT_NOT_SUPPORTED)
+ return -ENODEV;
+
+ ret = lock_device_hotplug_sysfs();
+ if (ret)
+ return ret;
+
+ if (ctrlval != cpu_smt_control) {
+ switch (ctrlval) {
+ case CPU_SMT_ENABLED:
+ cpuhp_smt_enable();
+ break;
+ case CPU_SMT_DISABLED:
+ case CPU_SMT_FORCE_DISABLED:
+ ret = cpuhp_smt_disable(ctrlval);
+ break;
+ }
+ }
+
+ unlock_device_hotplug();
+ return ret ? ret : count;
+}
+static DEVICE_ATTR(control, 0644, show_smt_control, store_smt_control);
+
+static ssize_t
+show_smt_active(struct device *dev, struct device_attribute *attr, char *buf)
+{
+ bool active = topology_max_smt_threads() > 1;
+
+ return snprintf(buf, PAGE_SIZE - 2, "%d\n", active);
+}
+static DEVICE_ATTR(active, 0444, show_smt_active, NULL);
+
+static struct attribute *cpuhp_smt_attrs[] = {
+ &dev_attr_control.attr,
+ &dev_attr_active.attr,
+ NULL
+};
+
+static const struct attribute_group cpuhp_smt_attr_group = {
+ .attrs = cpuhp_smt_attrs,
+ .name = "smt",
+ NULL
+};
+
+static int __init cpu_smt_state_init(void)
+{
+ if (!topology_smt_supported())
+ cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
+
+ return sysfs_create_group(&cpu_subsys.dev_root->kobj,
+ &cpuhp_smt_attr_group);
+}
+
+#else
+static inline int cpu_smt_state_init(void) { return 0; }
+#endif
+
static int __init cpuhp_sysfs_init(void)
{
int cpu, ret;
+ ret = cpu_smt_state_init();
+ if (ret)
+ return ret;
+
ret = sysfs_create_group(&cpu_subsys.dev_root->kobj,
&cpuhp_cpu_root_attr_group);
if (ret)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 042/107] x86/cpu: Remove the pointless CPU printout
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 041/107] cpu/hotplug: Provide knobs to control SMT Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 043/107] x86/cpu/AMD: Remove the pointless detect_ht() call Greg Kroah-Hartman
` (64 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Konrad Rzeszutek Wilk, Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 55e6d279abd92cfd7576bba031e7589be8475edb upstream
The value of this printout is dubious at best and there is no point in
having it in two different places along with convoluted ways to reach it.
Remove it completely.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/common.c | 20 +++++---------------
arch/x86/kernel/cpu/topology.c | 11 -----------
2 files changed, 5 insertions(+), 26 deletions(-)
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -611,13 +611,12 @@ void detect_ht(struct cpuinfo_x86 *c)
#ifdef CONFIG_SMP
u32 eax, ebx, ecx, edx;
int index_msb, core_bits;
- static bool printed;
if (!cpu_has(c, X86_FEATURE_HT))
return;
if (cpu_has(c, X86_FEATURE_CMP_LEGACY))
- goto out;
+ return;
if (cpu_has(c, X86_FEATURE_XTOPOLOGY))
return;
@@ -626,14 +625,14 @@ void detect_ht(struct cpuinfo_x86 *c)
smp_num_siblings = (ebx & 0xff0000) >> 16;
+ if (!smp_num_siblings)
+ smp_num_siblings = 1;
+
if (smp_num_siblings == 1) {
pr_info_once("CPU0: Hyper-Threading is disabled\n");
- goto out;
+ return;
}
- if (smp_num_siblings <= 1)
- goto out;
-
index_msb = get_count_order(smp_num_siblings);
c->phys_proc_id = apic->phys_pkg_id(c->initial_apicid, index_msb);
@@ -645,15 +644,6 @@ void detect_ht(struct cpuinfo_x86 *c)
c->cpu_core_id = apic->phys_pkg_id(c->initial_apicid, index_msb) &
((1 << core_bits) - 1);
-
-out:
- if (!printed && (c->x86_max_cores * smp_num_siblings) > 1) {
- pr_info("CPU: Physical Processor ID: %d\n",
- c->phys_proc_id);
- pr_info("CPU: Processor Core ID: %d\n",
- c->cpu_core_id);
- printed = 1;
- }
#endif
}
--- a/arch/x86/kernel/cpu/topology.c
+++ b/arch/x86/kernel/cpu/topology.c
@@ -32,7 +32,6 @@ void detect_extended_topology(struct cpu
unsigned int eax, ebx, ecx, edx, sub_index;
unsigned int ht_mask_width, core_plus_mask_width;
unsigned int core_select_mask, core_level_siblings;
- static bool printed;
if (c->cpuid_level < 0xb)
return;
@@ -85,15 +84,5 @@ void detect_extended_topology(struct cpu
c->apicid = apic->phys_pkg_id(c->initial_apicid, 0);
c->x86_max_cores = (core_level_siblings / smp_num_siblings);
-
- if (!printed) {
- pr_info("CPU: Physical Processor ID: %d\n",
- c->phys_proc_id);
- if (c->x86_max_cores > 1)
- pr_info("CPU: Processor Core ID: %d\n",
- c->cpu_core_id);
- printed = 1;
- }
- return;
#endif
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 043/107] x86/cpu/AMD: Remove the pointless detect_ht() call
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 042/107] x86/cpu: Remove the pointless CPU printout Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 044/107] x86/cpu/common: Provide detect_ht_early() Greg Kroah-Hartman
` (63 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Konrad Rzeszutek Wilk, Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 44ca36de56d1bf196dca2eb67cd753a46961ffe6 upstream
Real 32bit AMD CPUs do not have SMT and the only value of the call was to
reach the magic printout which got removed.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/amd.c | 4 ----
1 file changed, 4 deletions(-)
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -805,10 +805,6 @@ static void init_amd(struct cpuinfo_x86
srat_detect_node(c);
}
-#ifdef CONFIG_X86_32
- detect_ht(c);
-#endif
-
init_amd_cacheinfo(c);
if (c->x86 >= 0xf)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 044/107] x86/cpu/common: Provide detect_ht_early()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 043/107] x86/cpu/AMD: Remove the pointless detect_ht() call Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 045/107] x86/cpu/topology: Provide detect_extended_topology_early() Greg Kroah-Hartman
` (62 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Konrad Rzeszutek Wilk, Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 545401f4448a807b963ff17b575e0a393e68b523 upstream
To support force disabling of SMT it's required to know the number of
thread siblings early. detect_ht() cannot be called before the APIC driver
is selected, so split out the part which initializes smp_num_siblings.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/common.c | 24 ++++++++++++++----------
arch/x86/kernel/cpu/cpu.h | 1 +
2 files changed, 15 insertions(+), 10 deletions(-)
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -606,32 +606,36 @@ static void cpu_detect_tlb(struct cpuinf
tlb_lld_4m[ENTRIES], tlb_lld_1g[ENTRIES]);
}
-void detect_ht(struct cpuinfo_x86 *c)
+int detect_ht_early(struct cpuinfo_x86 *c)
{
#ifdef CONFIG_SMP
u32 eax, ebx, ecx, edx;
- int index_msb, core_bits;
if (!cpu_has(c, X86_FEATURE_HT))
- return;
+ return -1;
if (cpu_has(c, X86_FEATURE_CMP_LEGACY))
- return;
+ return -1;
if (cpu_has(c, X86_FEATURE_XTOPOLOGY))
- return;
+ return -1;
cpuid(1, &eax, &ebx, &ecx, &edx);
smp_num_siblings = (ebx & 0xff0000) >> 16;
+ if (smp_num_siblings == 1)
+ pr_info_once("CPU0: Hyper-Threading is disabled\n");
+#endif
+ return 0;
+}
- if (!smp_num_siblings)
- smp_num_siblings = 1;
+void detect_ht(struct cpuinfo_x86 *c)
+{
+#ifdef CONFIG_SMP
+ int index_msb, core_bits;
- if (smp_num_siblings == 1) {
- pr_info_once("CPU0: Hyper-Threading is disabled\n");
+ if (detect_ht_early(c) < 0)
return;
- }
index_msb = get_count_order(smp_num_siblings);
c->phys_proc_id = apic->phys_pkg_id(c->initial_apicid, index_msb);
--- a/arch/x86/kernel/cpu/cpu.h
+++ b/arch/x86/kernel/cpu/cpu.h
@@ -46,6 +46,7 @@ extern const struct cpu_dev *const __x86
extern void get_cpu_cap(struct cpuinfo_x86 *c);
extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c);
+extern int detect_ht_early(struct cpuinfo_x86 *c);
extern void x86_spec_ctrl_setup_ap(void);
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 045/107] x86/cpu/topology: Provide detect_extended_topology_early()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 044/107] x86/cpu/common: Provide detect_ht_early() Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 046/107] x86/cpu/intel: Evaluate smp_num_siblings early Greg Kroah-Hartman
` (61 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Konrad Rzeszutek Wilk, Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 95f3d39ccf7aaea79d1ffdac1c887c2e100ec1b6 upstream
To support force disabling of SMT it's required to know the number of
thread siblings early. detect_extended_topology() cannot be called before
the APIC driver is selected, so split out the part which initializes
smp_num_siblings.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/cpu.h | 1 +
arch/x86/kernel/cpu/topology.c | 30 ++++++++++++++++++++++++------
2 files changed, 25 insertions(+), 6 deletions(-)
--- a/arch/x86/kernel/cpu/cpu.h
+++ b/arch/x86/kernel/cpu/cpu.h
@@ -46,6 +46,7 @@ extern const struct cpu_dev *const __x86
extern void get_cpu_cap(struct cpuinfo_x86 *c);
extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c);
+extern int detect_extended_topology_early(struct cpuinfo_x86 *c);
extern int detect_ht_early(struct cpuinfo_x86 *c);
extern void x86_spec_ctrl_setup_ap(void);
--- a/arch/x86/kernel/cpu/topology.c
+++ b/arch/x86/kernel/cpu/topology.c
@@ -26,15 +26,13 @@
* exists, use it for populating initial_apicid and cpu topology
* detection.
*/
-void detect_extended_topology(struct cpuinfo_x86 *c)
+int detect_extended_topology_early(struct cpuinfo_x86 *c)
{
#ifdef CONFIG_SMP
- unsigned int eax, ebx, ecx, edx, sub_index;
- unsigned int ht_mask_width, core_plus_mask_width;
- unsigned int core_select_mask, core_level_siblings;
+ unsigned int eax, ebx, ecx, edx;
if (c->cpuid_level < 0xb)
- return;
+ return -1;
cpuid_count(0xb, SMT_LEVEL, &eax, &ebx, &ecx, &edx);
@@ -42,7 +40,7 @@ void detect_extended_topology(struct cpu
* check if the cpuid leaf 0xb is actually implemented.
*/
if (ebx == 0 || (LEAFB_SUBTYPE(ecx) != SMT_TYPE))
- return;
+ return -1;
set_cpu_cap(c, X86_FEATURE_XTOPOLOGY);
@@ -50,10 +48,30 @@ void detect_extended_topology(struct cpu
* initial apic id, which also represents 32-bit extended x2apic id.
*/
c->initial_apicid = edx;
+ smp_num_siblings = LEVEL_MAX_SIBLINGS(ebx);
+#endif
+ return 0;
+}
+
+/*
+ * Check for extended topology enumeration cpuid leaf 0xb and if it
+ * exists, use it for populating initial_apicid and cpu topology
+ * detection.
+ */
+void detect_extended_topology(struct cpuinfo_x86 *c)
+{
+#ifdef CONFIG_SMP
+ unsigned int eax, ebx, ecx, edx, sub_index;
+ unsigned int ht_mask_width, core_plus_mask_width;
+ unsigned int core_select_mask, core_level_siblings;
+
+ if (detect_extended_topology_early(c) < 0)
+ return;
/*
* Populate HT related information from sub-leaf level 0.
*/
+ cpuid_count(0xb, SMT_LEVEL, &eax, &ebx, &ecx, &edx);
core_level_siblings = smp_num_siblings = LEVEL_MAX_SIBLINGS(ebx);
core_plus_mask_width = ht_mask_width = BITS_SHIFT_NEXT_LEVEL(eax);
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 046/107] x86/cpu/intel: Evaluate smp_num_siblings early
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 045/107] x86/cpu/topology: Provide detect_extended_topology_early() Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 047/107] x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info Greg Kroah-Hartman
` (60 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Konrad Rzeszutek Wilk, Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 1910ad5624968f93be48e8e265513c54d66b897c upstream
Make use of the new early detection function to initialize smp_num_siblings
on the boot cpu before the MP-Table or ACPI/MADT scan happens. That's
required for force disabling SMT.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/intel.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -283,6 +283,13 @@ static void early_init_intel(struct cpui
}
check_mpx_erratum(c);
+
+ /*
+ * Get the number of SMT siblings early from the extended topology
+ * leaf, if available. Otherwise try the legacy SMT detection.
+ */
+ if (detect_extended_topology_early(c) < 0)
+ detect_ht_early(c);
}
#ifdef CONFIG_X86_32
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 047/107] x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 046/107] x86/cpu/intel: Evaluate smp_num_siblings early Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 048/107] x86/cpu/AMD: Evaluate smp_num_siblings early Greg Kroah-Hartman
` (59 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Borislav Petkov, Thomas Gleixner,
Ingo Molnar, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <bp@suse.de>
commit 119bff8a9c9bb00116a844ec68be7bc4b1c768f5 upstream
Old code used to check whether CPUID ext max level is >= 0x80000008 because
that last leaf contains the number of cores of the physical CPU. The three
functions called there now do not depend on that leaf anymore so the check
can go.
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/amd.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -799,11 +799,8 @@ static void init_amd(struct cpuinfo_x86
cpu_detect_cache_sizes(c);
- /* Multi core CPU? */
- if (c->extended_cpuid_level >= 0x80000008) {
- amd_detect_cmp(c);
- srat_detect_node(c);
- }
+ amd_detect_cmp(c);
+ srat_detect_node(c);
init_amd_cacheinfo(c);
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 048/107] x86/cpu/AMD: Evaluate smp_num_siblings early
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 047/107] x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 050/107] x86/speculation/l1tf: Extend 64bit swap file size limit Greg Kroah-Hartman
` (58 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Ingo Molnar,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 1e1d7e25fd759eddf96d8ab39d0a90a1979b2d8c upstream
To support force disabling of SMT it's required to know the number of
thread siblings early. amd_get_topology() cannot be called before the APIC
driver is selected, so split out the part which initializes
smp_num_siblings and invoke it from amd_early_init().
[dwmw2: Backport to 4.9]
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/amd.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -296,13 +296,24 @@ static int nearby_node(int apicid)
}
#endif
+#ifdef CONFIG_SMP
+
+static void amd_get_topology_early(struct cpuinfo_x86 *c)
+{
+ if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
+ u32 eax, ebx, ecx, edx;
+
+ cpuid(0x8000001e, &eax, &ebx, &ecx, &edx);
+ smp_num_siblings = ((ebx >> 8) & 0xff) + 1;
+ }
+}
+
/*
* Fixup core topology information for
* (1) AMD multi-node processors
* Assumption: Number of cores in each internal node is the same.
* (2) AMD processors supporting compute units
*/
-#ifdef CONFIG_SMP
static void amd_get_topology(struct cpuinfo_x86 *c)
{
u8 node_id;
@@ -633,6 +644,8 @@ static void early_init_amd(struct cpuinf
*/
if (cpu_has_amd_erratum(c, amd_erratum_400))
set_cpu_bug(c, X86_BUG_AMD_E400);
+
+ amd_get_topology_early(c);
}
static void init_amd_k8(struct cpuinfo_x86 *c)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 050/107] x86/speculation/l1tf: Extend 64bit swap file size limit
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 048/107] x86/cpu/AMD: Evaluate smp_num_siblings early Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 051/107] x86/cpufeatures: Add detection of L1D cache flush support Greg Kroah-Hartman
` (57 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vlastimil Babka, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <vbabka@suse.cz>
commit 1a7ed1ba4bba6c075d5ad61bb75e3fbc870840d6 upstream
The previous patch has limited swap file size so that large offsets cannot
clear bits above MAX_PA/2 in the pte and interfere with L1TF mitigation.
It assumed that offsets are encoded starting with bit 12, same as pfn. But
on x86_64, offsets are encoded starting with bit 9.
Thus the limit can be raised by 3 bits. That means 16TB with 42bit MAX_PA
and 256TB with 46bit MAX_PA.
Fixes: 377eeaa8e11f ("x86/speculation/l1tf: Limit swap file size to MAX_PA/2")
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/init.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -791,7 +791,15 @@ unsigned long max_swapfile_size(void)
if (boot_cpu_has_bug(X86_BUG_L1TF)) {
/* Limit the swap file size to MAX_PA/2 for L1TF workaround */
- pages = min_t(unsigned long, l1tf_pfn_limit() + 1, pages);
+ unsigned long l1tf_limit = l1tf_pfn_limit() + 1;
+ /*
+ * We encode swap offsets also with 3 bits below those for pfn
+ * which makes the usable limit higher.
+ */
+#ifdef CONFIG_X86_64
+ l1tf_limit <<= PAGE_SHIFT - SWP_OFFSET_FIRST_BIT;
+#endif
+ pages = min_t(unsigned long, l1tf_limit, pages);
}
return pages;
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 051/107] x86/cpufeatures: Add detection of L1D cache flush support.
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 050/107] x86/speculation/l1tf: Extend 64bit swap file size limit Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 052/107] x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings Greg Kroah-Hartman
` (56 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 11e34e64e4103955fc4568750914c75d65ea87ee upstream
336996-Speculative-Execution-Side-Channel-Mitigations.pdf defines a new MSR
(IA32_FLUSH_CMD) which is detected by CPUID.7.EDX[28]=1 bit being set.
This new MSR "gives software a way to invalidate structures with finer
granularity than other architectual methods like WBINVD."
A copy of this document is available at
https://bugzilla.kernel.org/show_bug.cgi?id=199511
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/cpufeatures.h | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -317,6 +317,7 @@
#define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */
#define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */
#define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */
+#define X86_FEATURE_FLUSH_L1D (18*32+28) /* Flush L1D cache */
#define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
#define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 052/107] x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 051/107] x86/cpufeatures: Add detection of L1D cache flush support Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 053/107] x86/speculation/l1tf: Protect PAE swap entries against L1TF Greg Kroah-Hartman
` (55 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Borislav Petkov, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <bp@suse.de>
commit 7ce2f0393ea2396142b7faf6ee9b1f3676d08a5f upstream
The TOPOEXT reenablement is a workaround for broken BIOSen which didn't
enable the CPUID bit. amd_get_topology_early(), however, relies on
that bit being set so that it can read out the CPUID leaf and set
smp_num_siblings properly.
Move the reenablement up to early_init_amd(). While at it, simplify
amd_get_topology_early().
[dwmw2: Backport to 4.9]
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/amd.c | 39 +++++++++++++++++++--------------------
1 file changed, 19 insertions(+), 20 deletions(-)
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -300,12 +300,8 @@ static int nearby_node(int apicid)
static void amd_get_topology_early(struct cpuinfo_x86 *c)
{
- if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
- u32 eax, ebx, ecx, edx;
-
- cpuid(0x8000001e, &eax, &ebx, &ecx, &edx);
- smp_num_siblings = ((ebx >> 8) & 0xff) + 1;
- }
+ if (cpu_has(c, X86_FEATURE_TOPOEXT))
+ smp_num_siblings = ((cpuid_ebx(0x8000001e) >> 8) & 0xff) + 1;
}
/*
@@ -326,7 +322,6 @@ static void amd_get_topology(struct cpui
cpuid(0x8000001e, &eax, &ebx, &ecx, &edx);
node_id = ecx & 0xff;
- smp_num_siblings = ((ebx >> 8) & 0xff) + 1;
if (c->x86 == 0x15)
c->cu_id = ebx & 0xff;
@@ -578,6 +573,8 @@ static void bsp_init_amd(struct cpuinfo_
static void early_init_amd(struct cpuinfo_x86 *c)
{
+ u64 value;
+
early_init_amd_mc(c);
/*
@@ -645,6 +642,21 @@ static void early_init_amd(struct cpuinf
if (cpu_has_amd_erratum(c, amd_erratum_400))
set_cpu_bug(c, X86_BUG_AMD_E400);
+
+ /* Re-enable TopologyExtensions if switched off by BIOS */
+ if (c->x86 == 0x15 &&
+ (c->x86_model >= 0x10 && c->x86_model <= 0x6f) &&
+ !cpu_has(c, X86_FEATURE_TOPOEXT)) {
+
+ if (msr_set_bit(0xc0011005, 54) > 0) {
+ rdmsrl(0xc0011005, value);
+ if (value & BIT_64(54)) {
+ set_cpu_cap(c, X86_FEATURE_TOPOEXT);
+ pr_info_once(FW_INFO "CPU: Re-enabling disabled Topology Extensions Support.\n");
+ }
+ }
+ }
+
amd_get_topology_early(c);
}
@@ -737,19 +749,6 @@ static void init_amd_bd(struct cpuinfo_x
{
u64 value;
- /* re-enable TopologyExtensions if switched off by BIOS */
- if ((c->x86_model >= 0x10) && (c->x86_model <= 0x6f) &&
- !cpu_has(c, X86_FEATURE_TOPOEXT)) {
-
- if (msr_set_bit(0xc0011005, 54) > 0) {
- rdmsrl(0xc0011005, value);
- if (value & BIT_64(54)) {
- set_cpu_cap(c, X86_FEATURE_TOPOEXT);
- pr_info_once(FW_INFO "CPU: Re-enabling disabled Topology Extensions Support.\n");
- }
- }
- }
-
/*
* The way access filter has a performance penalty on some workloads.
* Disable it on the affected CPUs.
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 053/107] x86/speculation/l1tf: Protect PAE swap entries against L1TF
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 052/107] x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 054/107] x86/speculation/l1tf: Fix up pte->pfn conversion for PAE Greg Kroah-Hartman
` (54 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vlastimil Babka, Thomas Gleixner,
Michal Hocko, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <vbabka@suse.cz>
commit 0d0f6249058834ffe1ceaad0bb31464af66f6e7a upstream
The PAE 3-level paging code currently doesn't mitigate L1TF by flipping the
offset bits, and uses the high PTE word, thus bits 32-36 for type, 37-63 for
offset. The lower word is zeroed, thus systems with less than 4GB memory are
safe. With 4GB to 128GB the swap type selects the memory locations vulnerable
to L1TF; with even more memory, also the swap offfset influences the address.
This might be a problem with 32bit PAE guests running on large 64bit hosts.
By continuing to keep the whole swap entry in either high or low 32bit word of
PTE we would limit the swap size too much. Thus this patch uses the whole PAE
PTE with the same layout as the 64bit version does. The macros just become a
bit tricky since they assume the arch-dependent swp_entry_t to be 32bit.
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable-3level.h | 35 ++++++++++++++++++++++++++++++++--
arch/x86/mm/init.c | 2 -
2 files changed, 34 insertions(+), 3 deletions(-)
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -177,12 +177,43 @@ static inline pmd_t native_pmdp_get_and_
#endif
/* Encode and de-code a swap entry */
+#define SWP_TYPE_BITS 5
+
+#define SWP_OFFSET_FIRST_BIT (_PAGE_BIT_PROTNONE + 1)
+
+/* We always extract/encode the offset by shifting it all the way up, and then down again */
+#define SWP_OFFSET_SHIFT (SWP_OFFSET_FIRST_BIT + SWP_TYPE_BITS)
+
#define MAX_SWAPFILES_CHECK() BUILD_BUG_ON(MAX_SWAPFILES_SHIFT > 5)
#define __swp_type(x) (((x).val) & 0x1f)
#define __swp_offset(x) ((x).val >> 5)
#define __swp_entry(type, offset) ((swp_entry_t){(type) | (offset) << 5})
-#define __pte_to_swp_entry(pte) ((swp_entry_t){ (pte).pte_high })
-#define __swp_entry_to_pte(x) ((pte_t){ { .pte_high = (x).val } })
+
+/*
+ * Normally, __swp_entry() converts from arch-independent swp_entry_t to
+ * arch-dependent swp_entry_t, and __swp_entry_to_pte() just stores the result
+ * to pte. But here we have 32bit swp_entry_t and 64bit pte, and need to use the
+ * whole 64 bits. Thus, we shift the "real" arch-dependent conversion to
+ * __swp_entry_to_pte() through the following helper macro based on 64bit
+ * __swp_entry().
+ */
+#define __swp_pteval_entry(type, offset) ((pteval_t) { \
+ (~(pteval_t)(offset) << SWP_OFFSET_SHIFT >> SWP_TYPE_BITS) \
+ | ((pteval_t)(type) << (64 - SWP_TYPE_BITS)) })
+
+#define __swp_entry_to_pte(x) ((pte_t){ .pte = \
+ __swp_pteval_entry(__swp_type(x), __swp_offset(x)) })
+/*
+ * Analogically, __pte_to_swp_entry() doesn't just extract the arch-dependent
+ * swp_entry_t, but also has to convert it from 64bit to the 32bit
+ * intermediate representation, using the following macros based on 64bit
+ * __swp_type() and __swp_offset().
+ */
+#define __pteval_swp_type(x) ((unsigned long)((x).pte >> (64 - SWP_TYPE_BITS)))
+#define __pteval_swp_offset(x) ((unsigned long)(~((x).pte) << SWP_TYPE_BITS >> SWP_OFFSET_SHIFT))
+
+#define __pte_to_swp_entry(pte) (__swp_entry(__pteval_swp_type(pte), \
+ __pteval_swp_offset(pte)))
#include <asm/pgtable-invert.h>
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -796,7 +796,7 @@ unsigned long max_swapfile_size(void)
* We encode swap offsets also with 3 bits below those for pfn
* which makes the usable limit higher.
*/
-#ifdef CONFIG_X86_64
+#if CONFIG_PGTABLE_LEVELS > 2
l1tf_limit <<= PAGE_SHIFT - SWP_OFFSET_FIRST_BIT;
#endif
pages = min_t(unsigned long, l1tf_limit, pages);
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 054/107] x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 053/107] x86/speculation/l1tf: Protect PAE swap entries against L1TF Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 055/107] Revert "x86/apic: Ignore secondary threads if nosmt=force" Greg Kroah-Hartman
` (53 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Beulich, Michal Hocko,
Thomas Gleixner, Vlastimil Babka, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <mhocko@suse.cz>
commit e14d7dfb41f5807a0c1c26a13f2b8ef16af24935 upstream
Jan has noticed that pte_pfn and co. resp. pfn_pte are incorrect for
CONFIG_PAE because phys_addr_t is wider than unsigned long and so the
pte_val reps. shift left would get truncated. Fix this up by using proper
types.
[dwmw2: Backport to 4.9]
Fixes: 6b28baca9b1f ("x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation")
Reported-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -171,21 +171,21 @@ static inline u64 protnone_mask(u64 val)
static inline unsigned long pte_pfn(pte_t pte)
{
- unsigned long pfn = pte_val(pte);
+ phys_addr_t pfn = pte_val(pte);
pfn ^= protnone_mask(pfn);
return (pfn & PTE_PFN_MASK) >> PAGE_SHIFT;
}
static inline unsigned long pmd_pfn(pmd_t pmd)
{
- unsigned long pfn = pmd_val(pmd);
+ phys_addr_t pfn = pmd_val(pmd);
pfn ^= protnone_mask(pfn);
return (pfn & pmd_pfn_mask(pmd)) >> PAGE_SHIFT;
}
static inline unsigned long pud_pfn(pud_t pud)
{
- unsigned long pfn = pud_val(pud);
+ phys_addr_t pfn = pud_val(pud);
pfn ^= protnone_mask(pfn);
return (pfn & pud_pfn_mask(pud)) >> PAGE_SHIFT;
}
@@ -404,7 +404,7 @@ static inline pgprotval_t massage_pgprot
static inline pte_t pfn_pte(unsigned long page_nr, pgprot_t pgprot)
{
- phys_addr_t pfn = page_nr << PAGE_SHIFT;
+ phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT;
pfn ^= protnone_mask(pgprot_val(pgprot));
pfn &= PTE_PFN_MASK;
return __pte(pfn | massage_pgprot(pgprot));
@@ -412,7 +412,7 @@ static inline pte_t pfn_pte(unsigned lon
static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot)
{
- phys_addr_t pfn = page_nr << PAGE_SHIFT;
+ phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT;
pfn ^= protnone_mask(pgprot_val(pgprot));
pfn &= PHYSICAL_PMD_PAGE_MASK;
return __pmd(pfn | massage_pgprot(pgprot));
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 055/107] Revert "x86/apic: Ignore secondary threads if nosmt=force"
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 054/107] x86/speculation/l1tf: Fix up pte->pfn conversion for PAE Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 056/107] cpu/hotplug: Boot HT siblings at least once Greg Kroah-Hartman
` (52 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Hansen, Thomas Gleixner,
Tony Luck, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 506a66f374891ff08e064a058c446b336c5ac760 upstream
Dave Hansen reported, that it's outright dangerous to keep SMT siblings
disabled completely so they are stuck in the BIOS and wait for SIPI.
The reason is that Machine Check Exceptions are broadcasted to siblings and
the soft disabled sibling has CR4.MCE = 0. If a MCE is delivered to a
logical core with CR4.MCE = 0, it asserts IERR#, which shuts down or
reboots the machine. The MCE chapter in the SDM contains the following
blurb:
Because the logical processors within a physical package are tightly
coupled with respect to shared hardware resources, both logical
processors are notified of machine check errors that occur within a
given physical processor. If machine-check exceptions are enabled when
a fatal error is reported, all the logical processors within a physical
package are dispatched to the machine-check exception handler. If
machine-check exceptions are disabled, the logical processors enter the
shutdown state and assert the IERR# signal. When enabling machine-check
exceptions, the MCE flag in control register CR4 should be set for each
logical processor.
Reverting the commit which ignores siblings at enumeration time solves only
half of the problem. The core cpuhotplug logic needs to be adjusted as
well.
This thoughtful engineered mechanism also turns the boot process on all
Intel HT enabled systems into a MCE lottery. MCE is enabled on the boot CPU
before the secondary CPUs are brought up. Depending on the number of
physical cores the window in which this situation can happen is smaller or
larger. On a HSW-EX it's about 750ms:
MCE is enabled on the boot CPU:
[ 0.244017] mce: CPU supports 22 MCE banks
The corresponding sibling #72 boots:
[ 1.008005] .... node #0, CPUs: #72
That means if an MCE hits on physical core 0 (logical CPUs 0 and 72)
between these two points the machine is going to shutdown. At least it's a
known safe state.
It's obvious that the early boot can be hit by an MCE as well and then runs
into the same situation because MCEs are not yet enabled on the boot CPU.
But after enabling them on the boot CPU, it does not make any sense to
prevent the kernel from recovering.
Adjust the nosmt kernel parameter documentation as well.
Reverts: 2207def700f9 ("x86/apic: Ignore secondary threads if nosmt=force")
Reported-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/kernel-parameters.txt | 8 ++------
arch/x86/include/asm/apic.h | 2 --
arch/x86/kernel/acpi/boot.c | 3 +--
arch/x86/kernel/apic/apic.c | 19 -------------------
4 files changed, 3 insertions(+), 29 deletions(-)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2695,12 +2695,8 @@ bytes respectively. Such letter suffixes
Equivalent to smt=1.
[KNL,x86] Disable symmetric multithreading (SMT).
- nosmt=force: Force disable SMT, similar to disabling
- it in the BIOS except that some of the
- resource partitioning effects which are
- caused by having SMT enabled in the BIOS
- cannot be undone. Depending on the CPU
- type this might have a performance impact.
+ nosmt=force: Force disable SMT, cannot be undone
+ via the sysfs control file.
nospectre_v2 [X86] Disable all mitigations for the Spectre variant 2
(indirect branch prediction) vulnerability. System may
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -636,10 +636,8 @@ extern int default_check_phys_apicid_pre
#ifdef CONFIG_SMP
bool apic_id_is_primary_thread(unsigned int id);
-bool apic_id_disabled(unsigned int id);
#else
static inline bool apic_id_is_primary_thread(unsigned int id) { return false; }
-static inline bool apic_id_disabled(unsigned int id) { return false; }
#endif
extern void irq_enter(void);
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -177,8 +177,7 @@ static int acpi_register_lapic(int id, u
}
if (!enabled) {
- if (!apic_id_disabled(id))
- ++disabled_cpus;
+ ++disabled_cpus;
return -EINVAL;
}
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -2056,16 +2056,6 @@ bool apic_id_is_primary_thread(unsigned
return !(apicid & mask);
}
-/**
- * apic_id_disabled - Check whether APIC ID is disabled via SMT control
- * @id: APIC ID to check
- */
-bool apic_id_disabled(unsigned int id)
-{
- return (cpu_smt_control == CPU_SMT_FORCE_DISABLED &&
- !apic_id_is_primary_thread(id));
-}
-
/*
* Should use this API to allocate logical CPU IDs to keep nr_logical_cpuids
* and cpuid_to_apicid[] synchronized.
@@ -2161,15 +2151,6 @@ int generic_processor_info(int apicid, i
return -EINVAL;
}
- /*
- * If SMT is force disabled and the APIC ID belongs to
- * a secondary thread, ignore it.
- */
- if (apic_id_disabled(apicid)) {
- pr_info_once("Ignoring secondary SMT threads\n");
- return -EINVAL;
- }
-
if (apicid == boot_cpu_physical_apicid) {
/*
* x86_bios_cpu_apicid is required to have processors listed
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 056/107] cpu/hotplug: Boot HT siblings at least once
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 055/107] Revert "x86/apic: Ignore secondary threads if nosmt=force" Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 057/107] x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present Greg Kroah-Hartman
` (51 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Hansen, Thomas Gleixner,
Tony Luck, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 0cc3cd21657be04cb0559fe8063f2130493f92cf upstream
Due to the way Machine Check Exceptions work on X86 hyperthreads it's
required to boot up _all_ logical cores at least once in order to set the
CR4.MCE bit.
So instead of ignoring the sibling threads right away, let them boot up
once so they can configure themselves. After they came out of the initial
boot stage check whether its a "secondary" sibling and cancel the operation
which puts the CPU back into offline state.
[dwmw2: Backport to 4.9]
Reported-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cpu.c | 72 +++++++++++++++++++++++++++++++++++++++--------------------
1 file changed, 48 insertions(+), 24 deletions(-)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -54,6 +54,7 @@ struct cpuhp_cpu_state {
bool rollback;
bool single;
bool bringup;
+ bool booted_once;
struct hlist_node *node;
enum cpuhp_state cb_state;
int result;
@@ -355,6 +356,40 @@ void cpu_hotplug_enable(void)
EXPORT_SYMBOL_GPL(cpu_hotplug_enable);
#endif /* CONFIG_HOTPLUG_CPU */
+#ifdef CONFIG_HOTPLUG_SMT
+enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
+
+static int __init smt_cmdline_disable(char *str)
+{
+ cpu_smt_control = CPU_SMT_DISABLED;
+ if (str && !strcmp(str, "force")) {
+ pr_info("SMT: Force disabled\n");
+ cpu_smt_control = CPU_SMT_FORCE_DISABLED;
+ }
+ return 0;
+}
+early_param("nosmt", smt_cmdline_disable);
+
+static inline bool cpu_smt_allowed(unsigned int cpu)
+{
+ if (cpu_smt_control == CPU_SMT_ENABLED)
+ return true;
+
+ if (topology_is_primary_thread(cpu))
+ return true;
+
+ /*
+ * On x86 it's required to boot all logical CPUs at least once so
+ * that the init code can get a chance to set CR4.MCE on each
+ * CPU. Otherwise, a broadacasted MCE observing CR4.MCE=0b on any
+ * core will shutdown the machine.
+ */
+ return !per_cpu(cpuhp_state, cpu).booted_once;
+}
+#else
+static inline bool cpu_smt_allowed(unsigned int cpu) { return true; }
+#endif
+
/* Need to know about CPUs going up/down? */
int register_cpu_notifier(struct notifier_block *nb)
{
@@ -431,6 +466,16 @@ static int bringup_wait_for_ap(unsigned
stop_machine_unpark(cpu);
kthread_unpark(st->thread);
+ /*
+ * SMT soft disabling on X86 requires to bring the CPU out of the
+ * BIOS 'wait for SIPI' state in order to set the CR4.MCE bit. The
+ * CPU marked itself as booted_once in cpu_notify_starting() so the
+ * cpu_smt_allowed() check will now return false if this is not the
+ * primary sibling.
+ */
+ if (!cpu_smt_allowed(cpu))
+ return -ECANCELED;
+
/* Should we go further up ? */
if (st->target > CPUHP_AP_ONLINE_IDLE) {
__cpuhp_kick_ap_work(st);
@@ -978,29 +1023,6 @@ int cpu_down(unsigned int cpu)
EXPORT_SYMBOL(cpu_down);
#endif /*CONFIG_HOTPLUG_CPU*/
-#ifdef CONFIG_HOTPLUG_SMT
-enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
-
-static int __init smt_cmdline_disable(char *str)
-{
- cpu_smt_control = CPU_SMT_DISABLED;
- if (str && !strcmp(str, "force")) {
- pr_info("SMT: Force disabled\n");
- cpu_smt_control = CPU_SMT_FORCE_DISABLED;
- }
- return 0;
-}
-early_param("nosmt", smt_cmdline_disable);
-
-static inline bool cpu_smt_allowed(unsigned int cpu)
-{
- return cpu_smt_control == CPU_SMT_ENABLED ||
- topology_is_primary_thread(cpu);
-}
-#else
-static inline bool cpu_smt_allowed(unsigned int cpu) { return true; }
-#endif
-
/**
* notify_cpu_starting(cpu) - Invoke the callbacks on the starting CPU
* @cpu: cpu that just started
@@ -1014,6 +1036,7 @@ void notify_cpu_starting(unsigned int cp
enum cpuhp_state target = min((int)st->target, CPUHP_AP_ONLINE);
rcu_cpu_starting(cpu); /* Enables RCU usage on this CPU. */
+ st->booted_once = true;
while (st->state < target) {
st->state++;
cpuhp_invoke_callback(cpu, st->state, true, NULL);
@@ -2114,5 +2137,6 @@ void __init boot_cpu_init(void)
*/
void __init boot_cpu_hotplug_init(void)
{
- per_cpu_ptr(&cpuhp_state, smp_processor_id())->state = CPUHP_ONLINE;
+ this_cpu_write(cpuhp_state.booted_once, true);
+ this_cpu_write(cpuhp_state.state, CPUHP_ONLINE);
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 057/107] x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 056/107] cpu/hotplug: Boot HT siblings at least once Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 058/107] x86/KVM/VMX: Add module argument for L1TF mitigation Greg Kroah-Hartman
` (50 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 26acfb666a473d960f0fd971fe68f3e3ad16c70b upstream
If the L1TF CPU bug is present we allow the KVM module to be loaded as the
major of users that use Linux and KVM have trusted guests and do not want a
broken setup.
Cloud vendors are the ones that are uncomfortable with CVE 2018-3620 and as
such they are the ones that should set nosmt to one.
Setting 'nosmt' means that the system administrator also needs to disable
SMT (Hyper-threading) in the BIOS, or via the 'nosmt' command line
parameter, or via the /sys/devices/system/cpu/smt/control. See commit
05736e4ac13c ("cpu/hotplug: Provide knobs to control SMT").
Other mitigations are to use task affinity, cpu sets, interrupt binding,
etc - anything to make sure that _only_ the same guests vCPUs are running
on sibling threads.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/kernel-parameters.txt | 6 ++++++
arch/x86/kvm/vmx.c | 19 +++++++++++++++++++
kernel/cpu.c | 1 +
3 files changed, 26 insertions(+)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1989,6 +1989,12 @@ bytes respectively. Such letter suffixes
for all guests.
Default is 1 (enabled) if in 64-bit or 32-bit PAE mode.
+ kvm-intel.nosmt=[KVM,Intel] If the L1TF CPU bug is present (CVE-2018-3620)
+ and the system has SMT (aka Hyper-Threading) enabled then
+ don't allow guests to be created.
+
+ Default is 0 (allow guests to be created).
+
kvm-intel.ept= [KVM,Intel] Disable extended page tables
(virtualized MMU) support on capable Intel chips.
Default is 1 (enabled)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -69,6 +69,9 @@ static const struct x86_cpu_id vmx_cpu_i
};
MODULE_DEVICE_TABLE(x86cpu, vmx_cpu_id);
+static bool __read_mostly nosmt;
+module_param(nosmt, bool, S_IRUGO);
+
static bool __read_mostly enable_vpid = 1;
module_param_named(vpid, enable_vpid, bool, 0444);
@@ -9298,6 +9301,20 @@ free_vcpu:
return ERR_PTR(err);
}
+#define L1TF_MSG "SMT enabled with L1TF CPU bug present. Refer to CVE-2018-3620 for details.\n"
+
+static int vmx_vm_init(struct kvm *kvm)
+{
+ if (boot_cpu_has(X86_BUG_L1TF) && cpu_smt_control == CPU_SMT_ENABLED) {
+ if (nosmt) {
+ pr_err(L1TF_MSG);
+ return -EOPNOTSUPP;
+ }
+ pr_warn(L1TF_MSG);
+ }
+ return 0;
+}
+
static void __init vmx_check_processor_compat(void *rtn)
{
struct vmcs_config vmcs_conf;
@@ -11367,6 +11384,8 @@ static struct kvm_x86_ops vmx_x86_ops __
.cpu_has_accelerated_tpr = report_flexpriority,
.has_emulated_msr = vmx_has_emulated_msr,
+ .vm_init = vmx_vm_init,
+
.vcpu_create = vmx_create_vcpu,
.vcpu_free = vmx_free_vcpu,
.vcpu_reset = vmx_vcpu_reset,
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -358,6 +358,7 @@ EXPORT_SYMBOL_GPL(cpu_hotplug_enable);
#ifdef CONFIG_HOTPLUG_SMT
enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
+EXPORT_SYMBOL_GPL(cpu_smt_control);
static int __init smt_cmdline_disable(char *str)
{
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 058/107] x86/KVM/VMX: Add module argument for L1TF mitigation
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 057/107] x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 059/107] x86/KVM/VMX: Add L1D flush algorithm Greg Kroah-Hartman
` (49 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit a399477e52c17e148746d3ce9a483f681c2aa9a0 upstream
Add a mitigation mode parameter "vmentry_l1d_flush" for CVE-2018-3620, aka
L1 terminal fault. The valid arguments are:
- "always" L1D cache flush on every VMENTER.
- "cond" Conditional L1D cache flush, explained below
- "never" Disable the L1D cache flush mitigation
"cond" is trying to avoid L1D cache flushes on VMENTER if the code executed
between VMEXIT and VMENTER is considered safe, i.e. is not bringing any
interesting information into L1D which might exploited.
[ tglx: Split out from a larger patch ]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/kernel-parameters.txt | 12 ++++++
arch/x86/kvm/vmx.c | 65 ++++++++++++++++++++++++++++++++++--
2 files changed, 75 insertions(+), 2 deletions(-)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2016,6 +2016,18 @@ bytes respectively. Such letter suffixes
(virtualized real and unpaged mode) on capable
Intel chips. Default is 1 (enabled)
+ kvm-intel.vmentry_l1d_flush=[KVM,Intel] Mitigation for L1 Terminal Fault
+ CVE-2018-3620.
+
+ Valid arguments: never, cond, always
+
+ always: L1D cache flush on every VMENTER.
+ cond: Flush L1D on VMENTER only when the code between
+ VMEXIT and VMENTER can leak host memory.
+ never: Disables the mitigation
+
+ Default is cond (do L1 cache flush in specific instances)
+
kvm-intel.vpid= [KVM,Intel] Disable Virtual Processor Identification
feature (tagged TLBs) on capable Intel chips.
Default is 1 (enabled)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -192,6 +192,54 @@ module_param(ple_window_max, int, S_IRUG
extern const ulong vmx_return;
+static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
+
+/* These MUST be in sync with vmentry_l1d_param order. */
+enum vmx_l1d_flush_state {
+ VMENTER_L1D_FLUSH_NEVER,
+ VMENTER_L1D_FLUSH_COND,
+ VMENTER_L1D_FLUSH_ALWAYS,
+};
+
+static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush = VMENTER_L1D_FLUSH_COND;
+
+static const struct {
+ const char *option;
+ enum vmx_l1d_flush_state cmd;
+} vmentry_l1d_param[] = {
+ {"never", VMENTER_L1D_FLUSH_NEVER},
+ {"cond", VMENTER_L1D_FLUSH_COND},
+ {"always", VMENTER_L1D_FLUSH_ALWAYS},
+};
+
+static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
+{
+ unsigned int i;
+
+ if (!s)
+ return -EINVAL;
+
+ for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
+ if (!strcmp(s, vmentry_l1d_param[i].option)) {
+ vmentry_l1d_flush = vmentry_l1d_param[i].cmd;
+ return 0;
+ }
+ }
+
+ return -EINVAL;
+}
+
+static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)
+{
+ return sprintf(s, "%s\n", vmentry_l1d_param[vmentry_l1d_flush].option);
+}
+
+static const struct kernel_param_ops vmentry_l1d_flush_ops = {
+ .set = vmentry_l1d_flush_set,
+ .get = vmentry_l1d_flush_get,
+};
+module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, &vmentry_l1d_flush, S_IRUGO);
+
#define NR_AUTOLOAD_MSRS 8
struct vmcs {
@@ -11505,10 +11553,23 @@ static struct kvm_x86_ops vmx_x86_ops __
.setup_mce = vmx_setup_mce,
};
+static void __init vmx_setup_l1d_flush(void)
+{
+ if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER ||
+ !boot_cpu_has_bug(X86_BUG_L1TF))
+ return;
+
+ static_branch_enable(&vmx_l1d_should_flush);
+}
+
static int __init vmx_init(void)
{
- int r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
- __alignof__(struct vcpu_vmx), THIS_MODULE);
+ int r;
+
+ vmx_setup_l1d_flush();
+
+ r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
+ __alignof__(struct vcpu_vmx), THIS_MODULE);
if (r)
return r;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 059/107] x86/KVM/VMX: Add L1D flush algorithm
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 058/107] x86/KVM/VMX: Add module argument for L1TF mitigation Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 060/107] x86/KVM/VMX: Add L1D MSR based flush Greg Kroah-Hartman
` (48 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit a47dd5f06714c844b33f3b5f517b6f3e81ce57b5 upstream
To mitigate the L1 Terminal Fault vulnerability it's required to flush L1D
on VMENTER to prevent rogue guests from snooping host memory.
CPUs will have a new control MSR via a microcode update to flush L1D with a
single MSR write, but in the absence of microcode a fallback to a software
based flush algorithm is required.
Add a software flush loop which is based on code from Intel.
[ tglx: Split out from combo patch ]
[ bpetkov: Polish the asm code ]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 66 insertions(+), 4 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8536,6 +8536,46 @@ static int vmx_handle_exit(struct kvm_vc
}
}
+/*
+ * Software based L1D cache flush which is used when microcode providing
+ * the cache control MSR is not loaded.
+ *
+ * The L1D cache is 32 KiB on Nehalem and later microarchitectures, but to
+ * flush it is required to read in 64 KiB because the replacement algorithm
+ * is not exactly LRU. This could be sized at runtime via topology
+ * information but as all relevant affected CPUs have 32KiB L1D cache size
+ * there is no point in doing so.
+ */
+#define L1D_CACHE_ORDER 4
+static void *vmx_l1d_flush_pages;
+
+static void __maybe_unused vmx_l1d_flush(void)
+{
+ int size = PAGE_SIZE << L1D_CACHE_ORDER;
+
+ asm volatile(
+ /* First ensure the pages are in the TLB */
+ "xorl %%eax, %%eax\n"
+ ".Lpopulate_tlb:\n\t"
+ "movzbl (%[empty_zp], %%" _ASM_AX "), %%ecx\n\t"
+ "addl $4096, %%eax\n\t"
+ "cmpl %%eax, %[size]\n\t"
+ "jne .Lpopulate_tlb\n\t"
+ "xorl %%eax, %%eax\n\t"
+ "cpuid\n\t"
+ /* Now fill the cache */
+ "xorl %%eax, %%eax\n"
+ ".Lfill_cache:\n"
+ "movzbl (%[empty_zp], %%" _ASM_AX "), %%ecx\n\t"
+ "addl $64, %%eax\n\t"
+ "cmpl %%eax, %[size]\n\t"
+ "jne .Lfill_cache\n\t"
+ "lfence\n"
+ :: [empty_zp] "r" (vmx_l1d_flush_pages),
+ [size] "r" (size)
+ : "eax", "ebx", "ecx", "edx");
+}
+
static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
{
struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
@@ -11553,25 +11593,45 @@ static struct kvm_x86_ops vmx_x86_ops __
.setup_mce = vmx_setup_mce,
};
-static void __init vmx_setup_l1d_flush(void)
+static int __init vmx_setup_l1d_flush(void)
{
+ struct page *page;
+
if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER ||
!boot_cpu_has_bug(X86_BUG_L1TF))
- return;
+ return 0;
+ page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
+ if (!page)
+ return -ENOMEM;
+
+ vmx_l1d_flush_pages = page_address(page);
static_branch_enable(&vmx_l1d_should_flush);
+ return 0;
+}
+
+static void vmx_free_l1d_flush_pages(void)
+{
+ if (vmx_l1d_flush_pages) {
+ free_pages((unsigned long)vmx_l1d_flush_pages, L1D_CACHE_ORDER);
+ vmx_l1d_flush_pages = NULL;
+ }
}
static int __init vmx_init(void)
{
int r;
- vmx_setup_l1d_flush();
+ r = vmx_setup_l1d_flush();
+ if (r)
+ return r;
r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
__alignof__(struct vcpu_vmx), THIS_MODULE);
- if (r)
+ if (r) {
+ vmx_free_l1d_flush_pages();
return r;
+ }
#ifdef CONFIG_KEXEC_CORE
rcu_assign_pointer(crash_vmclear_loaded_vmcss,
@@ -11589,6 +11649,8 @@ static void __exit vmx_exit(void)
#endif
kvm_exit();
+
+ vmx_free_l1d_flush_pages();
}
module_init(vmx_init)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 060/107] x86/KVM/VMX: Add L1D MSR based flush
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 059/107] x86/KVM/VMX: Add L1D flush algorithm Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 061/107] x86/KVM/VMX: Add L1D flush logic Greg Kroah-Hartman
` (47 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 3fa045be4c720146b18a19cea7a767dc6ad5df94 upstream
336996-Speculative-Execution-Side-Channel-Mitigations.pdf defines a new MSR
(IA32_FLUSH_CMD aka 0x10B) which has similar write-only semantics to other
MSRs defined in the document.
The semantics of this MSR is to allow "finer granularity invalidation of
caching structures than existing mechanisms like WBINVD. It will writeback
and invalidate the L1 data cache, including all cachelines brought in by
preceding instructions, without invalidating all caches (eg. L2 or
LLC). Some processors may also invalidate the first level level instruction
cache on a L1D_FLUSH command. The L1 data and instruction caches may be
shared across the logical processors of a core."
Use it instead of the loop based L1 flush algorithm.
A copy of this document is available at
https://bugzilla.kernel.org/show_bug.cgi?id=199511
[ tglx: Avoid allocating pages when the MSR is available ]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/msr-index.h | 6 ++++++
arch/x86/kvm/vmx.c | 15 +++++++++++----
2 files changed, 17 insertions(+), 4 deletions(-)
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -69,6 +69,12 @@
* control required.
*/
+#define MSR_IA32_FLUSH_CMD 0x0000010b
+#define L1D_FLUSH (1 << 0) /*
+ * Writeback and invalidate the
+ * L1 data cache.
+ */
+
#define MSR_IA32_BBL_CR_CTL 0x00000119
#define MSR_IA32_BBL_CR_CTL3 0x0000011e
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8553,6 +8553,11 @@ static void __maybe_unused vmx_l1d_flush
{
int size = PAGE_SIZE << L1D_CACHE_ORDER;
+ if (static_cpu_has(X86_FEATURE_FLUSH_L1D)) {
+ wrmsrl(MSR_IA32_FLUSH_CMD, L1D_FLUSH);
+ return;
+ }
+
asm volatile(
/* First ensure the pages are in the TLB */
"xorl %%eax, %%eax\n"
@@ -11601,11 +11606,13 @@ static int __init vmx_setup_l1d_flush(vo
!boot_cpu_has_bug(X86_BUG_L1TF))
return 0;
- page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
- if (!page)
- return -ENOMEM;
+ if (!boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
+ page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
+ if (!page)
+ return -ENOMEM;
+ vmx_l1d_flush_pages = page_address(page);
+ }
- vmx_l1d_flush_pages = page_address(page);
static_branch_enable(&vmx_l1d_should_flush);
return 0;
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 061/107] x86/KVM/VMX: Add L1D flush logic
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 060/107] x86/KVM/VMX: Add L1D MSR based flush Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 063/107] x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers Greg Kroah-Hartman
` (46 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit c595ceee45707f00f64f61c54fb64ef0cc0b4e85 upstream
Add the logic for flushing L1D on VMENTER. The flush depends on the static
key being enabled and the new l1tf_flush_l1d flag being set.
The flags is set:
- Always, if the flush module parameter is 'always'
- Conditionally at:
- Entry to vcpu_run(), i.e. after executing user space
- From the sched_in notifier, i.e. when switching to a vCPU thread.
- From vmexit handlers which are considered unsafe, i.e. where
sensitive data can be brought into L1D:
- The emulator, which could be a good target for other speculative
execution-based threats,
- The MMU, which can bring host page tables in the L1 cache.
- External interrupts
- Nested operations that require the MMU (see above). That is
vmptrld, vmptrst, vmclear,vmwrite,vmread.
- When handling invept,invvpid
[ tglx: Split out from combo patch and reduced to a single flag ]
[ dwmw2: Backported to 4.9, set l1tf_flush_l1d in svm/vmx code ]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/kvm_host.h | 4 ++++
arch/x86/kvm/svm.c | 2 ++
arch/x86/kvm/vmx.c | 23 ++++++++++++++++++++++-
arch/x86/kvm/x86.c | 8 ++++++++
4 files changed, 36 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -659,6 +659,9 @@ struct kvm_vcpu_arch {
int pending_ioapic_eoi;
int pending_external_vector;
+
+ /* Flush the L1 Data cache for L1TF mitigation on VMENTER */
+ bool l1tf_flush_l1d;
};
struct kvm_lpage_info {
@@ -819,6 +822,7 @@ struct kvm_vcpu_stat {
u64 signal_exits;
u64 irq_window_exits;
u64 nmi_window_exits;
+ u64 l1d_flush;
u64 halt_exits;
u64 halt_successful_poll;
u64 halt_attempted_poll;
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -2124,6 +2124,8 @@ static int pf_interception(struct vcpu_s
u32 error_code;
int r = 1;
+ svm->vcpu.arch.l1tf_flush_l1d = true;
+
switch (svm->apf_reason) {
default:
error_code = svm->vmcb->control.exit_info_1;
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5773,6 +5773,7 @@ static int handle_exception(struct kvm_v
BUG_ON(enable_ept);
cr2 = vmcs_readl(EXIT_QUALIFICATION);
trace_kvm_page_fault(cr2, error_code);
+ vcpu->arch.l1tf_flush_l1d = true;
if (kvm_event_needs_reinjection(vcpu))
kvm_mmu_unprotect_page_virt(vcpu, cr2);
@@ -8549,9 +8550,20 @@ static int vmx_handle_exit(struct kvm_vc
#define L1D_CACHE_ORDER 4
static void *vmx_l1d_flush_pages;
-static void __maybe_unused vmx_l1d_flush(void)
+static void vmx_l1d_flush(struct kvm_vcpu *vcpu)
{
int size = PAGE_SIZE << L1D_CACHE_ORDER;
+ bool always;
+
+ /*
+ * If the mitigation mode is 'flush always', keep the flush bit
+ * set, otherwise clear it. It gets set again either from
+ * vcpu_run() or from one of the unsafe VMEXIT handlers.
+ */
+ always = vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
+ vcpu->arch.l1tf_flush_l1d = always;
+
+ vcpu->stat.l1d_flush++;
if (static_cpu_has(X86_FEATURE_FLUSH_L1D)) {
wrmsrl(MSR_IA32_FLUSH_CMD, L1D_FLUSH);
@@ -8792,6 +8804,7 @@ static void vmx_handle_external_intr(str
[ss]"i"(__KERNEL_DS),
[cs]"i"(__KERNEL_CS)
);
+ vcpu->arch.l1tf_flush_l1d = true;
}
}
STACK_FRAME_NON_STANDARD(vmx_handle_external_intr);
@@ -9037,6 +9050,11 @@ static void __noclone vmx_vcpu_run(struc
vmx->__launched = vmx->loaded_vmcs->launched;
+ if (static_branch_unlikely(&vmx_l1d_should_flush)) {
+ if (vcpu->arch.l1tf_flush_l1d)
+ vmx_l1d_flush(vcpu);
+ }
+
asm(
/* Store host registers */
"push %%" _ASM_DX "; push %%" _ASM_BP ";"
@@ -10552,6 +10570,9 @@ static int nested_vmx_run(struct kvm_vcp
vmcs12->launch_state = 1;
+ /* Hide L1D cache contents from the nested guest. */
+ vmx->vcpu.arch.l1tf_flush_l1d = true;
+
if (vmcs12->guest_activity_state == GUEST_ACTIVITY_HLT)
return kvm_vcpu_halt(vcpu);
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -180,6 +180,7 @@ struct kvm_stats_debugfs_item debugfs_en
{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail) },
{ "irq_injections", VCPU_STAT(irq_injections) },
{ "nmi_injections", VCPU_STAT(nmi_injections) },
+ { "l1d_flush", VCPU_STAT(l1d_flush) },
{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) },
{ "mmu_pte_write", VM_STAT(mmu_pte_write) },
{ "mmu_pte_updated", VM_STAT(mmu_pte_updated) },
@@ -4476,6 +4477,9 @@ static int emulator_write_std(struct x86
int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, gva_t addr, void *val,
unsigned int bytes, struct x86_exception *exception)
{
+ /* kvm_write_guest_virt_system can pull in tons of pages. */
+ vcpu->arch.l1tf_flush_l1d = true;
+
return kvm_write_guest_virt_helper(addr, val, bytes, vcpu,
PFERR_WRITE_MASK, exception);
}
@@ -5574,6 +5578,8 @@ int x86_emulate_instruction(struct kvm_v
bool writeback = true;
bool write_fault_to_spt = vcpu->arch.write_fault_to_shadow_pgtable;
+ vcpu->arch.l1tf_flush_l1d = true;
+
/*
* Clear write_fault_to_shadow_pgtable here to ensure it is
* never reused.
@@ -6929,6 +6935,7 @@ static int vcpu_run(struct kvm_vcpu *vcp
struct kvm *kvm = vcpu->kvm;
vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
+ vcpu->arch.l1tf_flush_l1d = true;
for (;;) {
if (kvm_vcpu_running(vcpu)) {
@@ -7899,6 +7906,7 @@ void kvm_arch_vcpu_uninit(struct kvm_vcp
void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu)
{
+ vcpu->arch.l1tf_flush_l1d = true;
kvm_x86_ops->sched_in(vcpu, cpu);
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 063/107] x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 061/107] x86/KVM/VMX: Add L1D flush logic Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 064/107] x86/KVM/VMX: Add find_msr() helper function Greg Kroah-Hartman
` (45 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 33966dd6b2d2c352fae55412db2ea8cfff5df13a upstream
There is no semantic change but this change allows an unbalanced amount of
MSRs to be loaded on VMEXIT and VMENTER, i.e. the number of MSRs to save or
restore on VMEXIT or VMENTER may be different.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 65 ++++++++++++++++++++++++++++-------------------------
1 file changed, 35 insertions(+), 30 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -592,6 +592,11 @@ static inline int pi_test_sn(struct pi_d
(unsigned long *)&pi_desc->control);
}
+struct vmx_msrs {
+ unsigned int nr;
+ struct vmx_msr_entry val[NR_AUTOLOAD_MSRS];
+};
+
struct vcpu_vmx {
struct kvm_vcpu vcpu;
unsigned long host_rsp;
@@ -624,9 +629,8 @@ struct vcpu_vmx {
struct loaded_vmcs *loaded_vmcs;
bool __launched; /* temporary, used in vmx_vcpu_run */
struct msr_autoload {
- unsigned nr;
- struct vmx_msr_entry guest[NR_AUTOLOAD_MSRS];
- struct vmx_msr_entry host[NR_AUTOLOAD_MSRS];
+ struct vmx_msrs guest;
+ struct vmx_msrs host;
} msr_autoload;
struct {
int loaded;
@@ -1994,18 +1998,18 @@ static void clear_atomic_switch_msr(stru
}
break;
}
-
- for (i = 0; i < m->nr; ++i)
- if (m->guest[i].index == msr)
+ for (i = 0; i < m->guest.nr; ++i)
+ if (m->guest.val[i].index == msr)
break;
- if (i == m->nr)
+ if (i == m->guest.nr)
return;
- --m->nr;
- m->guest[i] = m->guest[m->nr];
- m->host[i] = m->host[m->nr];
- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->nr);
- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->nr);
+ --m->guest.nr;
+ --m->host.nr;
+ m->guest.val[i] = m->guest.val[m->guest.nr];
+ m->host.val[i] = m->host.val[m->host.nr];
+ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
}
static void add_atomic_switch_msr_special(struct vcpu_vmx *vmx,
@@ -2057,24 +2061,25 @@ static void add_atomic_switch_msr(struct
wrmsrl(MSR_IA32_PEBS_ENABLE, 0);
}
- for (i = 0; i < m->nr; ++i)
- if (m->guest[i].index == msr)
+ for (i = 0; i < m->guest.nr; ++i)
+ if (m->guest.val[i].index == msr)
break;
if (i == NR_AUTOLOAD_MSRS) {
printk_once(KERN_WARNING "Not enough msr switch entries. "
"Can't add msr %x\n", msr);
return;
- } else if (i == m->nr) {
- ++m->nr;
- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->nr);
- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->nr);
+ } else if (i == m->guest.nr) {
+ ++m->guest.nr;
+ ++m->host.nr;
+ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
}
- m->guest[i].index = msr;
- m->guest[i].value = guest_val;
- m->host[i].index = msr;
- m->host[i].value = host_val;
+ m->guest.val[i].index = msr;
+ m->guest.val[i].value = guest_val;
+ m->host.val[i].index = msr;
+ m->host.val[i].value = host_val;
}
static void reload_tss(void)
@@ -5316,9 +5321,9 @@ static int vmx_vcpu_setup(struct vcpu_vm
vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
- vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host));
+ vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val));
vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
- vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest));
+ vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val));
if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT)
vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat);
@@ -10224,10 +10229,10 @@ static void prepare_vmcs02(struct kvm_vc
* Set the MSR load/store lists to match L0's settings.
*/
vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.nr);
- vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host));
- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.nr);
- vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest));
+ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr);
+ vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val));
+ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr);
+ vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val));
/*
* HOST_RSP is normally set correctly in vmx_vcpu_run() just before
@@ -11076,8 +11081,8 @@ static void nested_vmx_vmexit(struct kvm
load_vmcs12_host_state(vcpu, vmcs12);
/* Update any VMCS fields that might have changed while L2 ran */
- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.nr);
- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.nr);
+ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr);
+ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr);
vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset);
if (vmx->hv_deadline_tsc == -1)
vmcs_clear_bits(PIN_BASED_VM_EXEC_CONTROL,
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 064/107] x86/KVM/VMX: Add find_msr() helper function
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 063/107] x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 065/107] x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting Greg Kroah-Hartman
` (44 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit ca83b4a7f2d068da79a029d323024aa45decb250 upstream
.. to help find the MSR on either the guest or host MSR list.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 31 ++++++++++++++++++-------------
1 file changed, 18 insertions(+), 13 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1975,9 +1975,20 @@ static void clear_atomic_switch_msr_spec
vm_exit_controls_clearbit(vmx, exit);
}
+static int find_msr(struct vmx_msrs *m, unsigned int msr)
+{
+ unsigned int i;
+
+ for (i = 0; i < m->nr; ++i) {
+ if (m->val[i].index == msr)
+ return i;
+ }
+ return -ENOENT;
+}
+
static void clear_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr)
{
- unsigned i;
+ int i;
struct msr_autoload *m = &vmx->msr_autoload;
switch (msr) {
@@ -1998,11 +2009,8 @@ static void clear_atomic_switch_msr(stru
}
break;
}
- for (i = 0; i < m->guest.nr; ++i)
- if (m->guest.val[i].index == msr)
- break;
-
- if (i == m->guest.nr)
+ i = find_msr(&m->guest, msr);
+ if (i < 0)
return;
--m->guest.nr;
--m->host.nr;
@@ -2026,7 +2034,7 @@ static void add_atomic_switch_msr_specia
static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
u64 guest_val, u64 host_val)
{
- unsigned i;
+ int i;
struct msr_autoload *m = &vmx->msr_autoload;
switch (msr) {
@@ -2061,16 +2069,13 @@ static void add_atomic_switch_msr(struct
wrmsrl(MSR_IA32_PEBS_ENABLE, 0);
}
- for (i = 0; i < m->guest.nr; ++i)
- if (m->guest.val[i].index == msr)
- break;
-
+ i = find_msr(&m->guest, msr);
if (i == NR_AUTOLOAD_MSRS) {
printk_once(KERN_WARNING "Not enough msr switch entries. "
"Can't add msr %x\n", msr);
return;
- } else if (i == m->guest.nr) {
- ++m->guest.nr;
+ } else if (i < 0) {
+ i = m->guest.nr++;
++m->host.nr;
vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 065/107] x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 064/107] x86/KVM/VMX: Add find_msr() helper function Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 066/107] x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs Greg Kroah-Hartman
` (43 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 3190709335dd31fe1aeeebfe4ffb6c7624ef971f upstream
This allows to load a different number of MSRs depending on the context:
VMEXIT or VMENTER.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 29 +++++++++++++++++++----------
1 file changed, 19 insertions(+), 10 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2011,12 +2011,18 @@ static void clear_atomic_switch_msr(stru
}
i = find_msr(&m->guest, msr);
if (i < 0)
- return;
+ goto skip_guest;
--m->guest.nr;
- --m->host.nr;
m->guest.val[i] = m->guest.val[m->guest.nr];
- m->host.val[i] = m->host.val[m->host.nr];
vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+
+skip_guest:
+ i = find_msr(&m->host, msr);
+ if (i < 0)
+ return;
+
+ --m->host.nr;
+ m->host.val[i] = m->host.val[m->host.nr];
vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
}
@@ -2034,7 +2040,7 @@ static void add_atomic_switch_msr_specia
static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
u64 guest_val, u64 host_val)
{
- int i;
+ int i, j;
struct msr_autoload *m = &vmx->msr_autoload;
switch (msr) {
@@ -2070,21 +2076,24 @@ static void add_atomic_switch_msr(struct
}
i = find_msr(&m->guest, msr);
- if (i == NR_AUTOLOAD_MSRS) {
+ j = find_msr(&m->host, msr);
+ if (i == NR_AUTOLOAD_MSRS || j == NR_AUTOLOAD_MSRS) {
printk_once(KERN_WARNING "Not enough msr switch entries. "
"Can't add msr %x\n", msr);
return;
- } else if (i < 0) {
+ }
+ if (i < 0) {
i = m->guest.nr++;
- ++m->host.nr;
vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+ }
+ if (j < 0) {
+ j = m->host.nr++;
vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
}
-
m->guest.val[i].index = msr;
m->guest.val[i].value = guest_val;
- m->host.val[i].index = msr;
- m->host.val[i].value = host_val;
+ m->host.val[j].index = msr;
+ m->host.val[j].value = host_val;
}
static void reload_tss(void)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 066/107] x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 065/107] x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 067/107] x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required Greg Kroah-Hartman
` (42 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 989e3992d2eca32c3f1404f2bc91acda3aa122d8 upstream
The IA32_FLUSH_CMD MSR needs only to be written on VMENTER. Extend
add_atomic_switch_msr() with an entry_only parameter to allow storing the
MSR only in the guest (ENTRY) MSR array.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2038,9 +2038,9 @@ static void add_atomic_switch_msr_specia
}
static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
- u64 guest_val, u64 host_val)
+ u64 guest_val, u64 host_val, bool entry_only)
{
- int i, j;
+ int i, j = 0;
struct msr_autoload *m = &vmx->msr_autoload;
switch (msr) {
@@ -2076,7 +2076,9 @@ static void add_atomic_switch_msr(struct
}
i = find_msr(&m->guest, msr);
- j = find_msr(&m->host, msr);
+ if (!entry_only)
+ j = find_msr(&m->host, msr);
+
if (i == NR_AUTOLOAD_MSRS || j == NR_AUTOLOAD_MSRS) {
printk_once(KERN_WARNING "Not enough msr switch entries. "
"Can't add msr %x\n", msr);
@@ -2086,12 +2088,16 @@ static void add_atomic_switch_msr(struct
i = m->guest.nr++;
vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
}
+ m->guest.val[i].index = msr;
+ m->guest.val[i].value = guest_val;
+
+ if (entry_only)
+ return;
+
if (j < 0) {
j = m->host.nr++;
vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
}
- m->guest.val[i].index = msr;
- m->guest.val[i].value = guest_val;
m->host.val[j].index = msr;
m->host.val[j].value = host_val;
}
@@ -2150,7 +2156,7 @@ static bool update_transition_efer(struc
guest_efer &= ~EFER_LME;
if (guest_efer != host_efer)
add_atomic_switch_msr(vmx, MSR_EFER,
- guest_efer, host_efer);
+ guest_efer, host_efer, false);
return false;
} else {
guest_efer &= ~ignore_bits;
@@ -3314,7 +3320,7 @@ static int vmx_set_msr(struct kvm_vcpu *
vcpu->arch.ia32_xss = data;
if (vcpu->arch.ia32_xss != host_xss)
add_atomic_switch_msr(vmx, MSR_IA32_XSS,
- vcpu->arch.ia32_xss, host_xss);
+ vcpu->arch.ia32_xss, host_xss, false);
else
clear_atomic_switch_msr(vmx, MSR_IA32_XSS);
break;
@@ -8985,7 +8991,7 @@ static void atomic_switch_perf_msrs(stru
clear_atomic_switch_msr(vmx, msrs[i].msr);
else
add_atomic_switch_msr(vmx, msrs[i].msr, msrs[i].guest,
- msrs[i].host);
+ msrs[i].host, false);
}
void vmx_arm_hv_timer(struct kvm_vcpu *vcpu)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 067/107] x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 066/107] x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 068/107] cpu/hotplug: Online siblings when SMT control is turned on Greg Kroah-Hartman
` (41 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 390d975e0c4e60ce70d4157e0dd91ede37824603 upstream
If the L1D flush module parameter is set to 'always' and the IA32_FLUSH_CMD
MSR is available, optimize the VMENTER code with the MSR save list.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 42 +++++++++++++++++++++++++++++++++++++-----
1 file changed, 37 insertions(+), 5 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5269,6 +5269,16 @@ static void ept_set_mmio_spte_mask(void)
kvm_mmu_set_mmio_spte_mask((0x3ull << 62) | 0x6ull);
}
+static bool vmx_l1d_use_msr_save_list(void)
+{
+ if (!enable_ept || !boot_cpu_has_bug(X86_BUG_L1TF) ||
+ static_cpu_has(X86_FEATURE_HYPERVISOR) ||
+ !static_cpu_has(X86_FEATURE_FLUSH_L1D))
+ return false;
+
+ return vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
+}
+
#define VMX_XSS_EXIT_BITMAP 0
/*
* Sets up the vmcs for emulated real mode.
@@ -5618,6 +5628,12 @@ static void vmx_set_nmi_mask(struct kvm_
vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
GUEST_INTR_STATE_NMI);
}
+ /*
+ * If flushing the L1D cache on every VMENTER is enforced and the
+ * MSR is available, use the MSR save list.
+ */
+ if (vmx_l1d_use_msr_save_list())
+ add_atomic_switch_msr(vmx, MSR_IA32_FLUSH_CMD, L1D_FLUSH, 0, true);
}
static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
@@ -8581,11 +8597,26 @@ static void vmx_l1d_flush(struct kvm_vcp
bool always;
/*
- * If the mitigation mode is 'flush always', keep the flush bit
- * set, otherwise clear it. It gets set again either from
- * vcpu_run() or from one of the unsafe VMEXIT handlers.
+ * This code is only executed when:
+ * - the flush mode is 'cond'
+ * - the flush mode is 'always' and the flush MSR is not
+ * available
+ *
+ * If the CPU has the flush MSR then clear the flush bit because
+ * 'always' mode is handled via the MSR save list.
+ *
+ * If the MSR is not avaibable then act depending on the mitigation
+ * mode: If 'flush always', keep the flush bit set, otherwise clear
+ * it.
+ *
+ * The flush bit gets set again either from vcpu_run() or from one
+ * of the unsafe VMEXIT handlers.
*/
- always = vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
+ if (static_cpu_has(X86_FEATURE_FLUSH_L1D))
+ always = false;
+ else
+ always = vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
+
vcpu->arch.l1tf_flush_l1d = always;
vcpu->stat.l1d_flush++;
@@ -11660,7 +11691,8 @@ static int __init vmx_setup_l1d_flush(vo
struct page *page;
if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER ||
- !boot_cpu_has_bug(X86_BUG_L1TF))
+ !boot_cpu_has_bug(X86_BUG_L1TF) ||
+ vmx_l1d_use_msr_save_list())
return 0;
if (!boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 068/107] cpu/hotplug: Online siblings when SMT control is turned on
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 067/107] x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 069/107] x86/litf: Introduce vmx status variable Greg Kroah-Hartman
` (40 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 215af5499d9e2b55f111d2431ea20218115f29b3 upstream
Writing 'off' to /sys/devices/system/cpu/smt/control offlines all SMT
siblings. Writing 'on' merily enables the abilify to online them, but does
not online them automatically.
Make 'on' more useful by onlining all offline siblings.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cpu.c | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1917,6 +1917,15 @@ static void cpuhp_offline_cpu_device(uns
kobject_uevent(&dev->kobj, KOBJ_OFFLINE);
}
+static void cpuhp_online_cpu_device(unsigned int cpu)
+{
+ struct device *dev = get_cpu_device(cpu);
+
+ dev->offline = false;
+ /* Tell user space about the state change */
+ kobject_uevent(&dev->kobj, KOBJ_ONLINE);
+}
+
static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
{
int cpu, ret = 0;
@@ -1949,11 +1958,24 @@ static int cpuhp_smt_disable(enum cpuhp_
return ret;
}
-static void cpuhp_smt_enable(void)
+static int cpuhp_smt_enable(void)
{
+ int cpu, ret = 0;
+
cpu_maps_update_begin();
cpu_smt_control = CPU_SMT_ENABLED;
+ for_each_present_cpu(cpu) {
+ /* Skip online CPUs and CPUs on offline nodes */
+ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
+ continue;
+ ret = _cpu_up(cpu, 0, CPUHP_ONLINE);
+ if (ret)
+ break;
+ /* See comment in cpuhp_smt_disable() */
+ cpuhp_online_cpu_device(cpu);
+ }
cpu_maps_update_done();
+ return ret;
}
static ssize_t
@@ -1984,7 +2006,7 @@ store_smt_control(struct device *dev, st
if (ctrlval != cpu_smt_control) {
switch (ctrlval) {
case CPU_SMT_ENABLED:
- cpuhp_smt_enable();
+ ret = cpuhp_smt_enable();
break;
case CPU_SMT_DISABLED:
case CPU_SMT_FORCE_DISABLED:
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 069/107] x86/litf: Introduce vmx status variable
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 068/107] cpu/hotplug: Online siblings when SMT control is turned on Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 070/107] x86/kvm: Drop L1TF MSR list approach Greg Kroah-Hartman
` (39 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Jiri Kosina,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 72c6d2db64fa18c996ece8f06e499509e6c9a37e upstream
Store the effective mitigation of VMX in a status variable and use it to
report the VMX state in the l1tf sysfs file.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142322.433098358@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/vmx.h | 9 +++++++++
arch/x86/kernel/cpu/bugs.c | 36 ++++++++++++++++++++++++++++++++++--
arch/x86/kvm/vmx.c | 22 +++++++++++-----------
3 files changed, 54 insertions(+), 13 deletions(-)
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -499,4 +499,13 @@ enum vm_instruction_error_number {
VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID = 28,
};
+enum vmx_l1d_flush_state {
+ VMENTER_L1D_FLUSH_AUTO,
+ VMENTER_L1D_FLUSH_NEVER,
+ VMENTER_L1D_FLUSH_COND,
+ VMENTER_L1D_FLUSH_ALWAYS,
+};
+
+extern enum vmx_l1d_flush_state l1tf_vmx_mitigation;
+
#endif
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -21,6 +21,7 @@
#include <asm/processor-flags.h>
#include <asm/fpu/internal.h>
#include <asm/msr.h>
+#include <asm/vmx.h>
#include <asm/paravirt.h>
#include <asm/alternative.h>
#include <asm/pgtable.h>
@@ -635,6 +636,12 @@ void x86_spec_ctrl_setup_ap(void)
#undef pr_fmt
#define pr_fmt(fmt) "L1TF: " fmt
+
+#if IS_ENABLED(CONFIG_KVM_INTEL)
+enum vmx_l1d_flush_state l1tf_vmx_mitigation __ro_after_init = VMENTER_L1D_FLUSH_AUTO;
+EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation);
+#endif
+
static void __init l1tf_select_mitigation(void)
{
u64 half_pa;
@@ -664,6 +671,32 @@ static void __init l1tf_select_mitigatio
#ifdef CONFIG_SYSFS
+#define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion"
+
+#if IS_ENABLED(CONFIG_KVM_INTEL)
+static const char *l1tf_vmx_states[] = {
+ [VMENTER_L1D_FLUSH_AUTO] = "auto",
+ [VMENTER_L1D_FLUSH_NEVER] = "vulnerable",
+ [VMENTER_L1D_FLUSH_COND] = "conditional cache flushes",
+ [VMENTER_L1D_FLUSH_ALWAYS] = "cache flushes",
+};
+
+static ssize_t l1tf_show_state(char *buf)
+{
+ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO)
+ return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
+
+ return sprintf(buf, "%s; VMX: SMT %s, L1D %s\n", L1TF_DEFAULT_MSG,
+ cpu_smt_control == CPU_SMT_ENABLED ? "vulnerable" : "disabled",
+ l1tf_vmx_states[l1tf_vmx_mitigation]);
+}
+#else
+static ssize_t l1tf_show_state(char *buf)
+{
+ return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
+}
+#endif
+
static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
char *buf, unsigned int bug)
{
@@ -691,9 +724,8 @@ static ssize_t cpu_show_common(struct de
case X86_BUG_L1TF:
if (boot_cpu_has(X86_FEATURE_L1TF_PTEINV))
- return sprintf(buf, "Mitigation: Page Table Inversion\n");
+ return l1tf_show_state(buf);
break;
-
default:
break;
}
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -194,19 +194,13 @@ extern const ulong vmx_return;
static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
-/* These MUST be in sync with vmentry_l1d_param order. */
-enum vmx_l1d_flush_state {
- VMENTER_L1D_FLUSH_NEVER,
- VMENTER_L1D_FLUSH_COND,
- VMENTER_L1D_FLUSH_ALWAYS,
-};
-
static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush = VMENTER_L1D_FLUSH_COND;
static const struct {
const char *option;
enum vmx_l1d_flush_state cmd;
} vmentry_l1d_param[] = {
+ {"auto", VMENTER_L1D_FLUSH_AUTO},
{"never", VMENTER_L1D_FLUSH_NEVER},
{"cond", VMENTER_L1D_FLUSH_COND},
{"always", VMENTER_L1D_FLUSH_ALWAYS},
@@ -11690,8 +11684,12 @@ static int __init vmx_setup_l1d_flush(vo
{
struct page *page;
+ if (!boot_cpu_has_bug(X86_BUG_L1TF))
+ return 0;
+
+ l1tf_vmx_mitigation = vmentry_l1d_flush;
+
if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER ||
- !boot_cpu_has_bug(X86_BUG_L1TF) ||
vmx_l1d_use_msr_save_list())
return 0;
@@ -11706,12 +11704,14 @@ static int __init vmx_setup_l1d_flush(vo
return 0;
}
-static void vmx_free_l1d_flush_pages(void)
+static void vmx_cleanup_l1d_flush(void)
{
if (vmx_l1d_flush_pages) {
free_pages((unsigned long)vmx_l1d_flush_pages, L1D_CACHE_ORDER);
vmx_l1d_flush_pages = NULL;
}
+ /* Restore state so sysfs ignores VMX */
+ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
}
static int __init vmx_init(void)
@@ -11725,7 +11725,7 @@ static int __init vmx_init(void)
r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
__alignof__(struct vcpu_vmx), THIS_MODULE);
if (r) {
- vmx_free_l1d_flush_pages();
+ vmx_cleanup_l1d_flush();
return r;
}
@@ -11746,7 +11746,7 @@ static void __exit vmx_exit(void)
kvm_exit();
- vmx_free_l1d_flush_pages();
+ vmx_cleanup_l1d_flush();
}
module_init(vmx_init)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 070/107] x86/kvm: Drop L1TF MSR list approach
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 069/107] x86/litf: Introduce vmx status variable Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 071/107] x86/l1tf: Handle EPT disabled state proper Greg Kroah-Hartman
` (38 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Jiri Kosina,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 2f055947ae5e2741fb2dc5bba1033c417ccf4faa upstream
The VMX module parameter to control the L1D flush should become
writeable.
The MSR list is set up at VM init per guest VCPU, but the run time
switching is based on a static key which is global. Toggling the MSR list
at run time might be feasible, but for now drop this optimization and use
the regular MSR write to make run-time switching possible.
The default mitigation is the conditional flush anyway, so for extra
paranoid setups this will add some small overhead, but the extra code
executed is in the noise compared to the flush itself.
Aside of that the EPT disabled case is not handled correctly at the moment
and the MSR list magic is in the way for fixing that as well.
If it's really providing a significant advantage, then this needs to be
revisited after the code is correct and the control is writable.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142322.516940445@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 43 +++++++------------------------------------
1 file changed, 7 insertions(+), 36 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5263,16 +5263,6 @@ static void ept_set_mmio_spte_mask(void)
kvm_mmu_set_mmio_spte_mask((0x3ull << 62) | 0x6ull);
}
-static bool vmx_l1d_use_msr_save_list(void)
-{
- if (!enable_ept || !boot_cpu_has_bug(X86_BUG_L1TF) ||
- static_cpu_has(X86_FEATURE_HYPERVISOR) ||
- !static_cpu_has(X86_FEATURE_FLUSH_L1D))
- return false;
-
- return vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
-}
-
#define VMX_XSS_EXIT_BITMAP 0
/*
* Sets up the vmcs for emulated real mode.
@@ -5622,12 +5612,6 @@ static void vmx_set_nmi_mask(struct kvm_
vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
GUEST_INTR_STATE_NMI);
}
- /*
- * If flushing the L1D cache on every VMENTER is enforced and the
- * MSR is available, use the MSR save list.
- */
- if (vmx_l1d_use_msr_save_list())
- add_atomic_switch_msr(vmx, MSR_IA32_FLUSH_CMD, L1D_FLUSH, 0, true);
}
static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
@@ -8591,26 +8575,14 @@ static void vmx_l1d_flush(struct kvm_vcp
bool always;
/*
- * This code is only executed when:
- * - the flush mode is 'cond'
- * - the flush mode is 'always' and the flush MSR is not
- * available
- *
- * If the CPU has the flush MSR then clear the flush bit because
- * 'always' mode is handled via the MSR save list.
- *
- * If the MSR is not avaibable then act depending on the mitigation
- * mode: If 'flush always', keep the flush bit set, otherwise clear
- * it.
+ * This code is only executed when the the flush mode is 'cond' or
+ * 'always'
*
- * The flush bit gets set again either from vcpu_run() or from one
- * of the unsafe VMEXIT handlers.
+ * If 'flush always', keep the flush bit set, otherwise clear
+ * it. The flush bit gets set again either from vcpu_run() or from
+ * one of the unsafe VMEXIT handlers.
*/
- if (static_cpu_has(X86_FEATURE_FLUSH_L1D))
- always = false;
- else
- always = vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
-
+ always = vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
vcpu->arch.l1tf_flush_l1d = always;
vcpu->stat.l1d_flush++;
@@ -11689,8 +11661,7 @@ static int __init vmx_setup_l1d_flush(vo
l1tf_vmx_mitigation = vmentry_l1d_flush;
- if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER ||
- vmx_l1d_use_msr_save_list())
+ if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER)
return 0;
if (!boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 071/107] x86/l1tf: Handle EPT disabled state proper
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 070/107] x86/kvm: Drop L1TF MSR list approach Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 072/107] x86/kvm: Move l1tf setup function Greg Kroah-Hartman
` (37 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Jiri Kosina,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit a7b9020b06ec6d7c3f3b0d4ef1a9eba12654f4f7 upstream
If Extended Page Tables (EPT) are disabled or not supported, no L1D
flushing is required. The setup function can just avoid setting up the L1D
flush for the EPT=n case.
Invoke it after the hardware setup has be done and enable_ept has the
correct state and expose the EPT disabled state in the mitigation status as
well.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142322.612160168@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/vmx.h | 1 +
arch/x86/kernel/cpu/bugs.c | 9 +++++----
arch/x86/kvm/vmx.c | 44 ++++++++++++++++++++++++++------------------
3 files changed, 32 insertions(+), 22 deletions(-)
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -504,6 +504,7 @@ enum vmx_l1d_flush_state {
VMENTER_L1D_FLUSH_NEVER,
VMENTER_L1D_FLUSH_COND,
VMENTER_L1D_FLUSH_ALWAYS,
+ VMENTER_L1D_FLUSH_EPT_DISABLED,
};
extern enum vmx_l1d_flush_state l1tf_vmx_mitigation;
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -675,10 +675,11 @@ static void __init l1tf_select_mitigatio
#if IS_ENABLED(CONFIG_KVM_INTEL)
static const char *l1tf_vmx_states[] = {
- [VMENTER_L1D_FLUSH_AUTO] = "auto",
- [VMENTER_L1D_FLUSH_NEVER] = "vulnerable",
- [VMENTER_L1D_FLUSH_COND] = "conditional cache flushes",
- [VMENTER_L1D_FLUSH_ALWAYS] = "cache flushes",
+ [VMENTER_L1D_FLUSH_AUTO] = "auto",
+ [VMENTER_L1D_FLUSH_NEVER] = "vulnerable",
+ [VMENTER_L1D_FLUSH_COND] = "conditional cache flushes",
+ [VMENTER_L1D_FLUSH_ALWAYS] = "cache flushes",
+ [VMENTER_L1D_FLUSH_EPT_DISABLED] = "EPT disabled",
};
static ssize_t l1tf_show_state(char *buf)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -11659,6 +11659,11 @@ static int __init vmx_setup_l1d_flush(vo
if (!boot_cpu_has_bug(X86_BUG_L1TF))
return 0;
+ if (!enable_ept) {
+ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED;
+ return 0;
+ }
+
l1tf_vmx_mitigation = vmentry_l1d_flush;
if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER)
@@ -11685,18 +11690,35 @@ static void vmx_cleanup_l1d_flush(void)
l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
}
+
+static void vmx_exit(void)
+{
+#ifdef CONFIG_KEXEC_CORE
+ RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL);
+ synchronize_rcu();
+#endif
+
+ kvm_exit();
+
+ vmx_cleanup_l1d_flush();
+}
+module_exit(vmx_exit)
+
static int __init vmx_init(void)
{
int r;
- r = vmx_setup_l1d_flush();
+ r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
+ __alignof__(struct vcpu_vmx), THIS_MODULE);
if (r)
return r;
- r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
- __alignof__(struct vcpu_vmx), THIS_MODULE);
+ /*
+ * Must be called after kvm_init() so enable_ept is properly set up
+ */
+ r = vmx_setup_l1d_flush();
if (r) {
- vmx_cleanup_l1d_flush();
+ vmx_exit();
return r;
}
@@ -11707,18 +11729,4 @@ static int __init vmx_init(void)
return 0;
}
-
-static void __exit vmx_exit(void)
-{
-#ifdef CONFIG_KEXEC_CORE
- RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL);
- synchronize_rcu();
-#endif
-
- kvm_exit();
-
- vmx_cleanup_l1d_flush();
-}
-
module_init(vmx_init)
-module_exit(vmx_exit)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 072/107] x86/kvm: Move l1tf setup function
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 071/107] x86/l1tf: Handle EPT disabled state proper Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 073/107] x86/kvm: Add static key for flush always Greg Kroah-Hartman
` (36 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Jiri Kosina,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 7db92e165ac814487264632ab2624e832f20ae38 upstream
In preparation of allowing run time control for L1D flushing, move the
setup code to the module parameter handler.
In case of pre module init parsing, just store the value and let vmx_init()
do the actual setup after running kvm_init() so that enable_ept is having
the correct state.
During run-time invoke it directly from the parameter setter to prepare for
run-time control.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142322.694063239@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 125 +++++++++++++++++++++++++++++++++--------------------
1 file changed, 78 insertions(+), 47 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -194,7 +194,8 @@ extern const ulong vmx_return;
static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
-static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush = VMENTER_L1D_FLUSH_COND;
+/* Storage for pre module init parameter parsing */
+static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_L1D_FLUSH_AUTO;
static const struct {
const char *option;
@@ -206,33 +207,85 @@ static const struct {
{"always", VMENTER_L1D_FLUSH_ALWAYS},
};
-static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
+#define L1D_CACHE_ORDER 4
+static void *vmx_l1d_flush_pages;
+
+static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
{
- unsigned int i;
+ struct page *page;
- if (!s)
- return -EINVAL;
+ /* If set to 'auto' select 'cond' */
+ if (l1tf == VMENTER_L1D_FLUSH_AUTO)
+ l1tf = VMENTER_L1D_FLUSH_COND;
- for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
- if (!strcmp(s, vmentry_l1d_param[i].option)) {
- vmentry_l1d_flush = vmentry_l1d_param[i].cmd;
- return 0;
- }
+ if (!enable_ept) {
+ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED;
+ return 0;
}
+ if (l1tf != VMENTER_L1D_FLUSH_NEVER && !vmx_l1d_flush_pages &&
+ !boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
+ page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
+ if (!page)
+ return -ENOMEM;
+ vmx_l1d_flush_pages = page_address(page);
+ }
+
+ l1tf_vmx_mitigation = l1tf;
+
+ if (l1tf != VMENTER_L1D_FLUSH_NEVER)
+ static_branch_enable(&vmx_l1d_should_flush);
+ return 0;
+}
+
+static int vmentry_l1d_flush_parse(const char *s)
+{
+ unsigned int i;
+
+ if (s) {
+ for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
+ if (!strcmp(s, vmentry_l1d_param[i].option))
+ return vmentry_l1d_param[i].cmd;
+ }
+ }
return -EINVAL;
}
+static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
+{
+ int l1tf;
+
+ if (!boot_cpu_has(X86_BUG_L1TF))
+ return 0;
+
+ l1tf = vmentry_l1d_flush_parse(s);
+ if (l1tf < 0)
+ return l1tf;
+
+ /*
+ * Has vmx_init() run already? If not then this is the pre init
+ * parameter parsing. In that case just store the value and let
+ * vmx_init() do the proper setup after enable_ept has been
+ * established.
+ */
+ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO) {
+ vmentry_l1d_flush_param = l1tf;
+ return 0;
+ }
+
+ return vmx_setup_l1d_flush(l1tf);
+}
+
static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)
{
- return sprintf(s, "%s\n", vmentry_l1d_param[vmentry_l1d_flush].option);
+ return sprintf(s, "%s\n", vmentry_l1d_param[l1tf_vmx_mitigation].option);
}
static const struct kernel_param_ops vmentry_l1d_flush_ops = {
.set = vmentry_l1d_flush_set,
.get = vmentry_l1d_flush_get,
};
-module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, &vmentry_l1d_flush, S_IRUGO);
+module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, S_IRUGO);
#define NR_AUTOLOAD_MSRS 8
@@ -8582,7 +8635,7 @@ static void vmx_l1d_flush(struct kvm_vcp
* it. The flush bit gets set again either from vcpu_run() or from
* one of the unsafe VMEXIT handlers.
*/
- always = vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
+ always = l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_ALWAYS;
vcpu->arch.l1tf_flush_l1d = always;
vcpu->stat.l1d_flush++;
@@ -11652,34 +11705,6 @@ static struct kvm_x86_ops vmx_x86_ops __
.setup_mce = vmx_setup_mce,
};
-static int __init vmx_setup_l1d_flush(void)
-{
- struct page *page;
-
- if (!boot_cpu_has_bug(X86_BUG_L1TF))
- return 0;
-
- if (!enable_ept) {
- l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED;
- return 0;
- }
-
- l1tf_vmx_mitigation = vmentry_l1d_flush;
-
- if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER)
- return 0;
-
- if (!boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
- page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
- if (!page)
- return -ENOMEM;
- vmx_l1d_flush_pages = page_address(page);
- }
-
- static_branch_enable(&vmx_l1d_should_flush);
- return 0;
-}
-
static void vmx_cleanup_l1d_flush(void)
{
if (vmx_l1d_flush_pages) {
@@ -11714,12 +11739,18 @@ static int __init vmx_init(void)
return r;
/*
- * Must be called after kvm_init() so enable_ept is properly set up
- */
- r = vmx_setup_l1d_flush();
- if (r) {
- vmx_exit();
- return r;
+ * Must be called after kvm_init() so enable_ept is properly set
+ * up. Hand the parameter mitigation value in which was stored in
+ * the pre module init parser. If no parameter was given, it will
+ * contain 'auto' which will be turned into the default 'cond'
+ * mitigation mode.
+ */
+ if (boot_cpu_has(X86_BUG_L1TF)) {
+ r = vmx_setup_l1d_flush(vmentry_l1d_flush_param);
+ if (r) {
+ vmx_exit();
+ return r;
+ }
}
#ifdef CONFIG_KEXEC_CORE
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 073/107] x86/kvm: Add static key for flush always
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 072/107] x86/kvm: Move l1tf setup function Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 074/107] x86/kvm: Serialize L1D flush parameter setter Greg Kroah-Hartman
` (35 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Jiri Kosina,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 4c6523ec59fe895ea352a650218a6be0653910b1 upstream
Avoid the conditional in the L1D flush control path.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142322.790914912@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -193,6 +193,7 @@ module_param(ple_window_max, int, S_IRUG
extern const ulong vmx_return;
static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
+static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_always);
/* Storage for pre module init parameter parsing */
static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_L1D_FLUSH_AUTO;
@@ -233,8 +234,12 @@ static int vmx_setup_l1d_flush(enum vmx_
l1tf_vmx_mitigation = l1tf;
- if (l1tf != VMENTER_L1D_FLUSH_NEVER)
- static_branch_enable(&vmx_l1d_should_flush);
+ if (l1tf == VMENTER_L1D_FLUSH_NEVER)
+ return 0;
+
+ static_branch_enable(&vmx_l1d_should_flush);
+ if (l1tf == VMENTER_L1D_FLUSH_ALWAYS)
+ static_branch_enable(&vmx_l1d_flush_always);
return 0;
}
@@ -8625,7 +8630,6 @@ static void *vmx_l1d_flush_pages;
static void vmx_l1d_flush(struct kvm_vcpu *vcpu)
{
int size = PAGE_SIZE << L1D_CACHE_ORDER;
- bool always;
/*
* This code is only executed when the the flush mode is 'cond' or
@@ -8635,8 +8639,10 @@ static void vmx_l1d_flush(struct kvm_vcp
* it. The flush bit gets set again either from vcpu_run() or from
* one of the unsafe VMEXIT handlers.
*/
- always = l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_ALWAYS;
- vcpu->arch.l1tf_flush_l1d = always;
+ if (static_branch_unlikely(&vmx_l1d_flush_always))
+ vcpu->arch.l1tf_flush_l1d = true;
+ else
+ vcpu->arch.l1tf_flush_l1d = false;
vcpu->stat.l1d_flush++;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 074/107] x86/kvm: Serialize L1D flush parameter setter
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 073/107] x86/kvm: Add static key for flush always Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 075/107] x86/kvm: Allow runtime control of L1D flush Greg Kroah-Hartman
` (34 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Jiri Kosina,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit dd4bfa739a72508b75760b393d129ed7b431daab upstream
Writes to the parameter files are not serialized at the sysfs core
level, so local serialization is required.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142322.873642605@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -194,6 +194,7 @@ extern const ulong vmx_return;
static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_always);
+static DEFINE_MUTEX(vmx_l1d_flush_mutex);
/* Storage for pre module init parameter parsing */
static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_L1D_FLUSH_AUTO;
@@ -258,7 +259,7 @@ static int vmentry_l1d_flush_parse(const
static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
{
- int l1tf;
+ int l1tf, ret;
if (!boot_cpu_has(X86_BUG_L1TF))
return 0;
@@ -278,7 +279,10 @@ static int vmentry_l1d_flush_set(const c
return 0;
}
- return vmx_setup_l1d_flush(l1tf);
+ mutex_lock(&vmx_l1d_flush_mutex);
+ ret = vmx_setup_l1d_flush(l1tf);
+ mutex_unlock(&vmx_l1d_flush_mutex);
+ return ret;
}
static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 075/107] x86/kvm: Allow runtime control of L1D flush
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 074/107] x86/kvm: Serialize L1D flush parameter setter Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 076/107] cpu/hotplug: Expose SMT control init function Greg Kroah-Hartman
` (33 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Jiri Kosina,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 895ae47f9918833c3a880fbccd41e0692b37e7d9 upstream
All mitigation modes can be switched at run time with a static key now:
- Use sysfs_streq() instead of strcmp() to handle the trailing new line
from sysfs writes correctly.
- Make the static key management handle multiple invocations properly.
- Set the module parameter file to RW
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142322.954525119@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/bugs.c | 2 +-
arch/x86/kvm/vmx.c | 13 ++++++++-----
2 files changed, 9 insertions(+), 6 deletions(-)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -638,7 +638,7 @@ void x86_spec_ctrl_setup_ap(void)
#define pr_fmt(fmt) "L1TF: " fmt
#if IS_ENABLED(CONFIG_KVM_INTEL)
-enum vmx_l1d_flush_state l1tf_vmx_mitigation __ro_after_init = VMENTER_L1D_FLUSH_AUTO;
+enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation);
#endif
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -235,12 +235,15 @@ static int vmx_setup_l1d_flush(enum vmx_
l1tf_vmx_mitigation = l1tf;
- if (l1tf == VMENTER_L1D_FLUSH_NEVER)
- return 0;
+ if (l1tf != VMENTER_L1D_FLUSH_NEVER)
+ static_branch_enable(&vmx_l1d_should_flush);
+ else
+ static_branch_disable(&vmx_l1d_should_flush);
- static_branch_enable(&vmx_l1d_should_flush);
if (l1tf == VMENTER_L1D_FLUSH_ALWAYS)
static_branch_enable(&vmx_l1d_flush_always);
+ else
+ static_branch_disable(&vmx_l1d_flush_always);
return 0;
}
@@ -250,7 +253,7 @@ static int vmentry_l1d_flush_parse(const
if (s) {
for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
- if (!strcmp(s, vmentry_l1d_param[i].option))
+ if (sysfs_streq(s, vmentry_l1d_param[i].option))
return vmentry_l1d_param[i].cmd;
}
}
@@ -294,7 +297,7 @@ static const struct kernel_param_ops vme
.set = vmentry_l1d_flush_set,
.get = vmentry_l1d_flush_get,
};
-module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, S_IRUGO);
+module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, 0644);
#define NR_AUTOLOAD_MSRS 8
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 076/107] cpu/hotplug: Expose SMT control init function
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 075/107] x86/kvm: Allow runtime control of L1D flush Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 077/107] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early Greg Kroah-Hartman
` (32 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Kosina, Thomas Gleixner,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.cz>
commit 8e1b706b6e819bed215c0db16345568864660393 upstream
The L1TF mitigation will gain a commend line parameter which allows to set
a combination of hypervisor mitigation and SMT control.
Expose cpu_smt_disable() so the command line parser can tweak SMT settings.
[ tglx: Split out of larger patch and made it preserve an already existing
force off state ]
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142323.039715135@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/cpu.h | 2 ++
kernel/cpu.c | 16 +++++++++++++---
2 files changed, 15 insertions(+), 3 deletions(-)
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -266,8 +266,10 @@ enum cpuhp_smt_control {
#if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
extern enum cpuhp_smt_control cpu_smt_control;
+extern void cpu_smt_disable(bool force);
#else
# define cpu_smt_control (CPU_SMT_ENABLED)
+static inline void cpu_smt_disable(bool force) { }
#endif
#endif /* _LINUX_CPU_H_ */
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -360,13 +360,23 @@ EXPORT_SYMBOL_GPL(cpu_hotplug_enable);
enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
EXPORT_SYMBOL_GPL(cpu_smt_control);
-static int __init smt_cmdline_disable(char *str)
+void __init cpu_smt_disable(bool force)
{
- cpu_smt_control = CPU_SMT_DISABLED;
- if (str && !strcmp(str, "force")) {
+ if (cpu_smt_control == CPU_SMT_FORCE_DISABLED ||
+ cpu_smt_control == CPU_SMT_NOT_SUPPORTED)
+ return;
+
+ if (force) {
pr_info("SMT: Force disabled\n");
cpu_smt_control = CPU_SMT_FORCE_DISABLED;
+ } else {
+ cpu_smt_control = CPU_SMT_DISABLED;
}
+}
+
+static int __init smt_cmdline_disable(char *str)
+{
+ cpu_smt_disable(str && !strcmp(str, "force"));
return 0;
}
early_param("nosmt", smt_cmdline_disable);
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 077/107] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 076/107] cpu/hotplug: Expose SMT control init function Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 078/107] x86/bugs, kvm: Introduce boot-time control of L1TF mitigations Greg Kroah-Hartman
` (31 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Jiri Kosina,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit fee0aede6f4739c87179eca76136f83210953b86 upstream
The CPU_SMT_NOT_SUPPORTED state is set (if the processor does not support
SMT) when the sysfs SMT control file is initialized.
That was fine so far as this was only required to make the output of the
control file correct and to prevent writes in that case.
With the upcoming l1tf command line parameter, this needs to be set up
before the L1TF mitigation selection and command line parsing happens.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142323.121795971@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/bugs.c | 6 ++++++
include/linux/cpu.h | 2 ++
kernel/cpu.c | 13 ++++++++++---
3 files changed, 18 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -57,6 +57,12 @@ void __init check_bugs(void)
{
identify_boot_cpu();
+ /*
+ * identify_boot_cpu() initialized SMT support information, let the
+ * core code know.
+ */
+ cpu_smt_check_topology();
+
if (!IS_ENABLED(CONFIG_SMP)) {
pr_info("CPU: ");
print_cpu_info(&boot_cpu_data);
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -267,9 +267,11 @@ enum cpuhp_smt_control {
#if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
extern enum cpuhp_smt_control cpu_smt_control;
extern void cpu_smt_disable(bool force);
+extern void cpu_smt_check_topology(void);
#else
# define cpu_smt_control (CPU_SMT_ENABLED)
static inline void cpu_smt_disable(bool force) { }
+static inline void cpu_smt_check_topology(void) { }
#endif
#endif /* _LINUX_CPU_H_ */
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -374,6 +374,16 @@ void __init cpu_smt_disable(bool force)
}
}
+/*
+ * The decision whether SMT is supported can only be done after the full
+ * CPU identification. Called from architecture code.
+ */
+void __init cpu_smt_check_topology(void)
+{
+ if (!topology_smt_supported())
+ cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
+}
+
static int __init smt_cmdline_disable(char *str)
{
cpu_smt_disable(str && !strcmp(str, "force"));
@@ -2053,9 +2063,6 @@ static const struct attribute_group cpuh
static int __init cpu_smt_state_init(void)
{
- if (!topology_smt_supported())
- cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
-
return sysfs_create_group(&cpu_subsys.dev_root->kobj,
&cpuhp_smt_attr_group);
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 078/107] x86/bugs, kvm: Introduce boot-time control of L1TF mitigations
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 077/107] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 079/107] Documentation: Add section about CPU vulnerabilities Greg Kroah-Hartman
` (30 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Kosina, Thomas Gleixner,
Josh Poimboeuf, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.cz>
commit d90a7a0ec83fb86622cd7dae23255d3c50a99ec8 upstream
Introduce the 'l1tf=' kernel command line option to allow for boot-time
switching of mitigation that is used on processors affected by L1TF.
The possible values are:
full
Provides all available mitigations for the L1TF vulnerability. Disables
SMT and enables all mitigations in the hypervisors. SMT control via
/sys/devices/system/cpu/smt/control is still possible after boot.
Hypervisors will issue a warning when the first VM is started in
a potentially insecure configuration, i.e. SMT enabled or L1D flush
disabled.
full,force
Same as 'full', but disables SMT control. Implies the 'nosmt=force'
command line option. sysfs control of SMT and the hypervisor flush
control is disabled.
flush
Leaves SMT enabled and enables the conditional hypervisor mitigation.
Hypervisors will issue a warning when the first VM is started in a
potentially insecure configuration, i.e. SMT enabled or L1D flush
disabled.
flush,nosmt
Disables SMT and enables the conditional hypervisor mitigation. SMT
control via /sys/devices/system/cpu/smt/control is still possible
after boot. If SMT is reenabled or flushing disabled at runtime
hypervisors will issue a warning.
flush,nowarn
Same as 'flush', but hypervisors will not warn when
a VM is started in a potentially insecure configuration.
off
Disables hypervisor mitigations and doesn't emit any warnings.
Default is 'flush'.
Let KVM adhere to these semantics, which means:
- 'lt1f=full,force' : Performe L1D flushes. No runtime control
possible.
- 'l1tf=full'
- 'l1tf-flush'
- 'l1tf=flush,nosmt' : Perform L1D flushes and warn on VM start if
SMT has been runtime enabled or L1D flushing
has been run-time enabled
- 'l1tf=flush,nowarn' : Perform L1D flushes and no warnings are emitted.
- 'l1tf=off' : L1D flushes are not performed and no warnings
are emitted.
KVM can always override the L1D flushing behavior using its 'vmentry_l1d_flush'
module parameter except when lt1f=full,force is set.
This makes KVM's private 'nosmt' option redundant, and as it is a bit
non-systematic anyway (this is something to control globally, not on
hypervisor level), remove that option.
Add the missing Documentation entry for the l1tf vulnerability sysfs file
while at it.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142323.202758176@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/sysfs-devices-system-cpu | 4 +
Documentation/kernel-parameters.txt | 68 +++++++++++++++++++--
arch/x86/include/asm/processor.h | 12 +++
arch/x86/kernel/cpu/bugs.c | 44 +++++++++++++
arch/x86/kvm/vmx.c | 56 +++++++++++++----
5 files changed, 165 insertions(+), 19 deletions(-)
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -356,6 +356,7 @@ What: /sys/devices/system/cpu/vulnerabi
/sys/devices/system/cpu/vulnerabilities/spectre_v1
/sys/devices/system/cpu/vulnerabilities/spectre_v2
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
+ /sys/devices/system/cpu/vulnerabilities/l1tf
Date: January 2018
Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
Description: Information about CPU vulnerabilities
@@ -368,6 +369,9 @@ Description: Information about CPU vulne
"Vulnerable" CPU is affected and no mitigation in effect
"Mitigation: $M" CPU is affected and mitigation $M is in effect
+ Details about the l1tf file can be found in
+ Documentation/admin-guide/l1tf.rst
+
What: /sys/devices/system/cpu/smt
/sys/devices/system/cpu/smt/active
/sys/devices/system/cpu/smt/control
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1989,12 +1989,6 @@ bytes respectively. Such letter suffixes
for all guests.
Default is 1 (enabled) if in 64-bit or 32-bit PAE mode.
- kvm-intel.nosmt=[KVM,Intel] If the L1TF CPU bug is present (CVE-2018-3620)
- and the system has SMT (aka Hyper-Threading) enabled then
- don't allow guests to be created.
-
- Default is 0 (allow guests to be created).
-
kvm-intel.ept= [KVM,Intel] Disable extended page tables
(virtualized MMU) support on capable Intel chips.
Default is 1 (enabled)
@@ -2032,6 +2026,68 @@ bytes respectively. Such letter suffixes
feature (tagged TLBs) on capable Intel chips.
Default is 1 (enabled)
+ l1tf= [X86] Control mitigation of the L1TF vulnerability on
+ affected CPUs
+
+ The kernel PTE inversion protection is unconditionally
+ enabled and cannot be disabled.
+
+ full
+ Provides all available mitigations for the
+ L1TF vulnerability. Disables SMT and
+ enables all mitigations in the
+ hypervisors, i.e. unconditional L1D flush.
+
+ SMT control and L1D flush control via the
+ sysfs interface is still possible after
+ boot. Hypervisors will issue a warning
+ when the first VM is started in a
+ potentially insecure configuration,
+ i.e. SMT enabled or L1D flush disabled.
+
+ full,force
+ Same as 'full', but disables SMT and L1D
+ flush runtime control. Implies the
+ 'nosmt=force' command line option.
+ (i.e. sysfs control of SMT is disabled.)
+
+ flush
+ Leaves SMT enabled and enables the default
+ hypervisor mitigation, i.e. conditional
+ L1D flush.
+
+ SMT control and L1D flush control via the
+ sysfs interface is still possible after
+ boot. Hypervisors will issue a warning
+ when the first VM is started in a
+ potentially insecure configuration,
+ i.e. SMT enabled or L1D flush disabled.
+
+ flush,nosmt
+
+ Disables SMT and enables the default
+ hypervisor mitigation.
+
+ SMT control and L1D flush control via the
+ sysfs interface is still possible after
+ boot. Hypervisors will issue a warning
+ when the first VM is started in a
+ potentially insecure configuration,
+ i.e. SMT enabled or L1D flush disabled.
+
+ flush,nowarn
+ Same as 'flush', but hypervisors will not
+ warn when a VM is started in a potentially
+ insecure configuration.
+
+ off
+ Disables hypervisor mitigations and doesn't
+ emit any warnings.
+
+ Default is 'flush'.
+
+ For details see: Documentation/admin-guide/l1tf.rst
+
l2cr= [PPC]
l3cr= [PPC]
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -860,4 +860,16 @@ bool xen_set_default_idle(void);
void stop_this_cpu(void *dummy);
void df_debug(struct pt_regs *regs, long error_code);
+
+enum l1tf_mitigations {
+ L1TF_MITIGATION_OFF,
+ L1TF_MITIGATION_FLUSH_NOWARN,
+ L1TF_MITIGATION_FLUSH,
+ L1TF_MITIGATION_FLUSH_NOSMT,
+ L1TF_MITIGATION_FULL,
+ L1TF_MITIGATION_FULL_FORCE
+};
+
+extern enum l1tf_mitigations l1tf_mitigation;
+
#endif /* _ASM_X86_PROCESSOR_H */
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -643,7 +643,11 @@ void x86_spec_ctrl_setup_ap(void)
#undef pr_fmt
#define pr_fmt(fmt) "L1TF: " fmt
+/* Default mitigation for L1TF-affected CPUs */
+enum l1tf_mitigations l1tf_mitigation __ro_after_init = L1TF_MITIGATION_FLUSH;
#if IS_ENABLED(CONFIG_KVM_INTEL)
+EXPORT_SYMBOL_GPL(l1tf_mitigation);
+
enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation);
#endif
@@ -655,6 +659,20 @@ static void __init l1tf_select_mitigatio
if (!boot_cpu_has_bug(X86_BUG_L1TF))
return;
+ switch (l1tf_mitigation) {
+ case L1TF_MITIGATION_OFF:
+ case L1TF_MITIGATION_FLUSH_NOWARN:
+ case L1TF_MITIGATION_FLUSH:
+ break;
+ case L1TF_MITIGATION_FLUSH_NOSMT:
+ case L1TF_MITIGATION_FULL:
+ cpu_smt_disable(false);
+ break;
+ case L1TF_MITIGATION_FULL_FORCE:
+ cpu_smt_disable(true);
+ break;
+ }
+
#if CONFIG_PGTABLE_LEVELS == 2
pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n");
return;
@@ -673,6 +691,32 @@ static void __init l1tf_select_mitigatio
setup_force_cpu_cap(X86_FEATURE_L1TF_PTEINV);
}
+
+static int __init l1tf_cmdline(char *str)
+{
+ if (!boot_cpu_has_bug(X86_BUG_L1TF))
+ return 0;
+
+ if (!str)
+ return -EINVAL;
+
+ if (!strcmp(str, "off"))
+ l1tf_mitigation = L1TF_MITIGATION_OFF;
+ else if (!strcmp(str, "flush,nowarn"))
+ l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOWARN;
+ else if (!strcmp(str, "flush"))
+ l1tf_mitigation = L1TF_MITIGATION_FLUSH;
+ else if (!strcmp(str, "flush,nosmt"))
+ l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT;
+ else if (!strcmp(str, "full"))
+ l1tf_mitigation = L1TF_MITIGATION_FULL;
+ else if (!strcmp(str, "full,force"))
+ l1tf_mitigation = L1TF_MITIGATION_FULL_FORCE;
+
+ return 0;
+}
+early_param("l1tf", l1tf_cmdline);
+
#undef pr_fmt
#ifdef CONFIG_SYSFS
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -69,9 +69,6 @@ static const struct x86_cpu_id vmx_cpu_i
};
MODULE_DEVICE_TABLE(x86cpu, vmx_cpu_id);
-static bool __read_mostly nosmt;
-module_param(nosmt, bool, S_IRUGO);
-
static bool __read_mostly enable_vpid = 1;
module_param_named(vpid, enable_vpid, bool, 0444);
@@ -216,15 +213,31 @@ static int vmx_setup_l1d_flush(enum vmx_
{
struct page *page;
- /* If set to 'auto' select 'cond' */
- if (l1tf == VMENTER_L1D_FLUSH_AUTO)
- l1tf = VMENTER_L1D_FLUSH_COND;
-
if (!enable_ept) {
l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED;
return 0;
}
+ /* If set to auto use the default l1tf mitigation method */
+ if (l1tf == VMENTER_L1D_FLUSH_AUTO) {
+ switch (l1tf_mitigation) {
+ case L1TF_MITIGATION_OFF:
+ l1tf = VMENTER_L1D_FLUSH_NEVER;
+ break;
+ case L1TF_MITIGATION_FLUSH_NOWARN:
+ case L1TF_MITIGATION_FLUSH:
+ case L1TF_MITIGATION_FLUSH_NOSMT:
+ l1tf = VMENTER_L1D_FLUSH_COND;
+ break;
+ case L1TF_MITIGATION_FULL:
+ case L1TF_MITIGATION_FULL_FORCE:
+ l1tf = VMENTER_L1D_FLUSH_ALWAYS;
+ break;
+ }
+ } else if (l1tf_mitigation == L1TF_MITIGATION_FULL_FORCE) {
+ l1tf = VMENTER_L1D_FLUSH_ALWAYS;
+ }
+
if (l1tf != VMENTER_L1D_FLUSH_NEVER && !vmx_l1d_flush_pages &&
!boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
@@ -9500,16 +9513,33 @@ free_vcpu:
return ERR_PTR(err);
}
-#define L1TF_MSG "SMT enabled with L1TF CPU bug present. Refer to CVE-2018-3620 for details.\n"
+#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.\n"
+#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.\n"
static int vmx_vm_init(struct kvm *kvm)
{
- if (boot_cpu_has(X86_BUG_L1TF) && cpu_smt_control == CPU_SMT_ENABLED) {
- if (nosmt) {
- pr_err(L1TF_MSG);
- return -EOPNOTSUPP;
+ if (boot_cpu_has(X86_BUG_L1TF) && enable_ept) {
+ switch (l1tf_mitigation) {
+ case L1TF_MITIGATION_OFF:
+ case L1TF_MITIGATION_FLUSH_NOWARN:
+ /* 'I explicitly don't care' is set */
+ break;
+ case L1TF_MITIGATION_FLUSH:
+ case L1TF_MITIGATION_FLUSH_NOSMT:
+ case L1TF_MITIGATION_FULL:
+ /*
+ * Warn upon starting the first VM in a potentially
+ * insecure environment.
+ */
+ if (cpu_smt_control == CPU_SMT_ENABLED)
+ pr_warn_once(L1TF_MSG_SMT);
+ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
+ pr_warn_once(L1TF_MSG_L1D);
+ break;
+ case L1TF_MITIGATION_FULL_FORCE:
+ /* Flush is enforced */
+ break;
}
- pr_warn(L1TF_MSG);
}
return 0;
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 079/107] Documentation: Add section about CPU vulnerabilities
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 078/107] x86/bugs, kvm: Introduce boot-time control of L1TF mitigations Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 080/107] x86/KVM/VMX: Initialize the vmx_l1d_flush_pages content Greg Kroah-Hartman
` (29 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Josh Poimboeuf,
Linus Torvalds, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 3ec8ce5d866ec6a08a9cfab82b62acf4a830b35f upstream
Add documentation for the L1TF vulnerability and the mitigation mechanisms:
- Explain the problem and risks
- Document the mitigation mechanisms
- Document the command line controls
- Document the sysfs files
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://lkml.kernel.org/r/20180713142323.287429944@linutronix.de
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/index.rst | 1
Documentation/l1tf.rst | 591 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 592 insertions(+)
create mode 100644 Documentation/l1tf.rst
--- a/Documentation/index.rst
+++ b/Documentation/index.rst
@@ -12,6 +12,7 @@ Contents:
:maxdepth: 2
kernel-documentation
+ l1tf
development-process/index
dev-tools/tools
driver-api/index
--- /dev/null
+++ b/Documentation/l1tf.rst
@@ -0,0 +1,591 @@
+L1TF - L1 Terminal Fault
+========================
+
+L1 Terminal Fault is a hardware vulnerability which allows unprivileged
+speculative access to data which is available in the Level 1 Data Cache
+when the page table entry controlling the virtual address, which is used
+for the access, has the Present bit cleared or other reserved bits set.
+
+Affected processors
+-------------------
+
+This vulnerability affects a wide range of Intel processors. The
+vulnerability is not present on:
+
+ - Processors from AMD, Centaur and other non Intel vendors
+
+ - Older processor models, where the CPU family is < 6
+
+ - A range of Intel ATOM processors (Cedarview, Cloverview, Lincroft,
+ Penwell, Pineview, Slivermont, Airmont, Merrifield)
+
+ - The Intel Core Duo Yonah variants (2006 - 2008)
+
+ - The Intel XEON PHI family
+
+ - Intel processors which have the ARCH_CAP_RDCL_NO bit set in the
+ IA32_ARCH_CAPABILITIES MSR. If the bit is set the CPU is not affected
+ by the Meltdown vulnerability either. These CPUs should become
+ available by end of 2018.
+
+Whether a processor is affected or not can be read out from the L1TF
+vulnerability file in sysfs. See :ref:`l1tf_sys_info`.
+
+Related CVEs
+------------
+
+The following CVE entries are related to the L1TF vulnerability:
+
+ ============= ================= ==============================
+ CVE-2018-3615 L1 Terminal Fault SGX related aspects
+ CVE-2018-3620 L1 Terminal Fault OS, SMM related aspects
+ CVE-2018-3646 L1 Terminal Fault Virtualization related aspects
+ ============= ================= ==============================
+
+Problem
+-------
+
+If an instruction accesses a virtual address for which the relevant page
+table entry (PTE) has the Present bit cleared or other reserved bits set,
+then speculative execution ignores the invalid PTE and loads the referenced
+data if it is present in the Level 1 Data Cache, as if the page referenced
+by the address bits in the PTE was still present and accessible.
+
+While this is a purely speculative mechanism and the instruction will raise
+a page fault when it is retired eventually, the pure act of loading the
+data and making it available to other speculative instructions opens up the
+opportunity for side channel attacks to unprivileged malicious code,
+similar to the Meltdown attack.
+
+While Meltdown breaks the user space to kernel space protection, L1TF
+allows to attack any physical memory address in the system and the attack
+works across all protection domains. It allows an attack of SGX and also
+works from inside virtual machines because the speculation bypasses the
+extended page table (EPT) protection mechanism.
+
+
+Attack scenarios
+----------------
+
+1. Malicious user space
+^^^^^^^^^^^^^^^^^^^^^^^
+
+ Operating Systems store arbitrary information in the address bits of a
+ PTE which is marked non present. This allows a malicious user space
+ application to attack the physical memory to which these PTEs resolve.
+ In some cases user-space can maliciously influence the information
+ encoded in the address bits of the PTE, thus making attacks more
+ deterministic and more practical.
+
+ The Linux kernel contains a mitigation for this attack vector, PTE
+ inversion, which is permanently enabled and has no performance
+ impact. The kernel ensures that the address bits of PTEs, which are not
+ marked present, never point to cacheable physical memory space.
+
+ A system with an up to date kernel is protected against attacks from
+ malicious user space applications.
+
+2. Malicious guest in a virtual machine
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+ The fact that L1TF breaks all domain protections allows malicious guest
+ OSes, which can control the PTEs directly, and malicious guest user
+ space applications, which run on an unprotected guest kernel lacking the
+ PTE inversion mitigation for L1TF, to attack physical host memory.
+
+ A special aspect of L1TF in the context of virtualization is symmetric
+ multi threading (SMT). The Intel implementation of SMT is called
+ HyperThreading. The fact that Hyperthreads on the affected processors
+ share the L1 Data Cache (L1D) is important for this. As the flaw allows
+ only to attack data which is present in L1D, a malicious guest running
+ on one Hyperthread can attack the data which is brought into the L1D by
+ the context which runs on the sibling Hyperthread of the same physical
+ core. This context can be host OS, host user space or a different guest.
+
+ If the processor does not support Extended Page Tables, the attack is
+ only possible, when the hypervisor does not sanitize the content of the
+ effective (shadow) page tables.
+
+ While solutions exist to mitigate these attack vectors fully, these
+ mitigations are not enabled by default in the Linux kernel because they
+ can affect performance significantly. The kernel provides several
+ mechanisms which can be utilized to address the problem depending on the
+ deployment scenario. The mitigations, their protection scope and impact
+ are described in the next sections.
+
+ The default mitigations and the rationale for chosing them are explained
+ at the end of this document. See :ref:`default_mitigations`.
+
+.. _l1tf_sys_info:
+
+L1TF system information
+-----------------------
+
+The Linux kernel provides a sysfs interface to enumerate the current L1TF
+status of the system: whether the system is vulnerable, and which
+mitigations are active. The relevant sysfs file is:
+
+/sys/devices/system/cpu/vulnerabilities/l1tf
+
+The possible values in this file are:
+
+ =========================== ===============================
+ 'Not affected' The processor is not vulnerable
+ 'Mitigation: PTE Inversion' The host protection is active
+ =========================== ===============================
+
+If KVM/VMX is enabled and the processor is vulnerable then the following
+information is appended to the 'Mitigation: PTE Inversion' part:
+
+ - SMT status:
+
+ ===================== ================
+ 'VMX: SMT vulnerable' SMT is enabled
+ 'VMX: SMT disabled' SMT is disabled
+ ===================== ================
+
+ - L1D Flush mode:
+
+ ================================ ====================================
+ 'L1D vulnerable' L1D flushing is disabled
+
+ 'L1D conditional cache flushes' L1D flush is conditionally enabled
+
+ 'L1D cache flushes' L1D flush is unconditionally enabled
+ ================================ ====================================
+
+The resulting grade of protection is discussed in the following sections.
+
+
+Host mitigation mechanism
+-------------------------
+
+The kernel is unconditionally protected against L1TF attacks from malicious
+user space running on the host.
+
+
+Guest mitigation mechanisms
+---------------------------
+
+.. _l1d_flush:
+
+1. L1D flush on VMENTER
+^^^^^^^^^^^^^^^^^^^^^^^
+
+ To make sure that a guest cannot attack data which is present in the L1D
+ the hypervisor flushes the L1D before entering the guest.
+
+ Flushing the L1D evicts not only the data which should not be accessed
+ by a potentially malicious guest, it also flushes the guest
+ data. Flushing the L1D has a performance impact as the processor has to
+ bring the flushed guest data back into the L1D. Depending on the
+ frequency of VMEXIT/VMENTER and the type of computations in the guest
+ performance degradation in the range of 1% to 50% has been observed. For
+ scenarios where guest VMEXIT/VMENTER are rare the performance impact is
+ minimal. Virtio and mechanisms like posted interrupts are designed to
+ confine the VMEXITs to a bare minimum, but specific configurations and
+ application scenarios might still suffer from a high VMEXIT rate.
+
+ The kernel provides two L1D flush modes:
+ - conditional ('cond')
+ - unconditional ('always')
+
+ The conditional mode avoids L1D flushing after VMEXITs which execute
+ only audited code pathes before the corresponding VMENTER. These code
+ pathes have beed verified that they cannot expose secrets or other
+ interesting data to an attacker, but they can leak information about the
+ address space layout of the hypervisor.
+
+ Unconditional mode flushes L1D on all VMENTER invocations and provides
+ maximum protection. It has a higher overhead than the conditional
+ mode. The overhead cannot be quantified correctly as it depends on the
+ work load scenario and the resulting number of VMEXITs.
+
+ The general recommendation is to enable L1D flush on VMENTER. The kernel
+ defaults to conditional mode on affected processors.
+
+ **Note**, that L1D flush does not prevent the SMT problem because the
+ sibling thread will also bring back its data into the L1D which makes it
+ attackable again.
+
+ L1D flush can be controlled by the administrator via the kernel command
+ line and sysfs control files. See :ref:`mitigation_control_command_line`
+ and :ref:`mitigation_control_kvm`.
+
+.. _guest_confinement:
+
+2. Guest VCPU confinement to dedicated physical cores
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+ To address the SMT problem, it is possible to make a guest or a group of
+ guests affine to one or more physical cores. The proper mechanism for
+ that is to utilize exclusive cpusets to ensure that no other guest or
+ host tasks can run on these cores.
+
+ If only a single guest or related guests run on sibling SMT threads on
+ the same physical core then they can only attack their own memory and
+ restricted parts of the host memory.
+
+ Host memory is attackable, when one of the sibling SMT threads runs in
+ host OS (hypervisor) context and the other in guest context. The amount
+ of valuable information from the host OS context depends on the context
+ which the host OS executes, i.e. interrupts, soft interrupts and kernel
+ threads. The amount of valuable data from these contexts cannot be
+ declared as non-interesting for an attacker without deep inspection of
+ the code.
+
+ **Note**, that assigning guests to a fixed set of physical cores affects
+ the ability of the scheduler to do load balancing and might have
+ negative effects on CPU utilization depending on the hosting
+ scenario. Disabling SMT might be a viable alternative for particular
+ scenarios.
+
+ For further information about confining guests to a single or to a group
+ of cores consult the cpusets documentation:
+
+ https://www.kernel.org/doc/Documentation/cgroup-v1/cpusets.txt
+
+.. _interrupt_isolation:
+
+3. Interrupt affinity
+^^^^^^^^^^^^^^^^^^^^^
+
+ Interrupts can be made affine to logical CPUs. This is not universally
+ true because there are types of interrupts which are truly per CPU
+ interrupts, e.g. the local timer interrupt. Aside of that multi queue
+ devices affine their interrupts to single CPUs or groups of CPUs per
+ queue without allowing the administrator to control the affinities.
+
+ Moving the interrupts, which can be affinity controlled, away from CPUs
+ which run untrusted guests, reduces the attack vector space.
+
+ Whether the interrupts with are affine to CPUs, which run untrusted
+ guests, provide interesting data for an attacker depends on the system
+ configuration and the scenarios which run on the system. While for some
+ of the interrupts it can be assumed that they wont expose interesting
+ information beyond exposing hints about the host OS memory layout, there
+ is no way to make general assumptions.
+
+ Interrupt affinity can be controlled by the administrator via the
+ /proc/irq/$NR/smp_affinity[_list] files. Limited documentation is
+ available at:
+
+ https://www.kernel.org/doc/Documentation/IRQ-affinity.txt
+
+.. _smt_control:
+
+4. SMT control
+^^^^^^^^^^^^^^
+
+ To prevent the SMT issues of L1TF it might be necessary to disable SMT
+ completely. Disabling SMT can have a significant performance impact, but
+ the impact depends on the hosting scenario and the type of workloads.
+ The impact of disabling SMT needs also to be weighted against the impact
+ of other mitigation solutions like confining guests to dedicated cores.
+
+ The kernel provides a sysfs interface to retrieve the status of SMT and
+ to control it. It also provides a kernel command line interface to
+ control SMT.
+
+ The kernel command line interface consists of the following options:
+
+ =========== ==========================================================
+ nosmt Affects the bring up of the secondary CPUs during boot. The
+ kernel tries to bring all present CPUs online during the
+ boot process. "nosmt" makes sure that from each physical
+ core only one - the so called primary (hyper) thread is
+ activated. Due to a design flaw of Intel processors related
+ to Machine Check Exceptions the non primary siblings have
+ to be brought up at least partially and are then shut down
+ again. "nosmt" can be undone via the sysfs interface.
+
+ nosmt=force Has the same effect as "nosmt' but it does not allow to
+ undo the SMT disable via the sysfs interface.
+ =========== ==========================================================
+
+ The sysfs interface provides two files:
+
+ - /sys/devices/system/cpu/smt/control
+ - /sys/devices/system/cpu/smt/active
+
+ /sys/devices/system/cpu/smt/control:
+
+ This file allows to read out the SMT control state and provides the
+ ability to disable or (re)enable SMT. The possible states are:
+
+ ============== ===================================================
+ on SMT is supported by the CPU and enabled. All
+ logical CPUs can be onlined and offlined without
+ restrictions.
+
+ off SMT is supported by the CPU and disabled. Only
+ the so called primary SMT threads can be onlined
+ and offlined without restrictions. An attempt to
+ online a non-primary sibling is rejected
+
+ forceoff Same as 'off' but the state cannot be controlled.
+ Attempts to write to the control file are rejected.
+
+ notsupported The processor does not support SMT. It's therefore
+ not affected by the SMT implications of L1TF.
+ Attempts to write to the control file are rejected.
+ ============== ===================================================
+
+ The possible states which can be written into this file to control SMT
+ state are:
+
+ - on
+ - off
+ - forceoff
+
+ /sys/devices/system/cpu/smt/active:
+
+ This file reports whether SMT is enabled and active, i.e. if on any
+ physical core two or more sibling threads are online.
+
+ SMT control is also possible at boot time via the l1tf kernel command
+ line parameter in combination with L1D flush control. See
+ :ref:`mitigation_control_command_line`.
+
+5. Disabling EPT
+^^^^^^^^^^^^^^^^
+
+ Disabling EPT for virtual machines provides full mitigation for L1TF even
+ with SMT enabled, because the effective page tables for guests are
+ managed and sanitized by the hypervisor. Though disabling EPT has a
+ significant performance impact especially when the Meltdown mitigation
+ KPTI is enabled.
+
+ EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter.
+
+There is ongoing research and development for new mitigation mechanisms to
+address the performance impact of disabling SMT or EPT.
+
+.. _mitigation_control_command_line:
+
+Mitigation control on the kernel command line
+---------------------------------------------
+
+The kernel command line allows to control the L1TF mitigations at boot
+time with the option "l1tf=". The valid arguments for this option are:
+
+ ============ =============================================================
+ full Provides all available mitigations for the L1TF
+ vulnerability. Disables SMT and enables all mitigations in
+ the hypervisors, i.e. unconditional L1D flushing
+
+ SMT control and L1D flush control via the sysfs interface
+ is still possible after boot. Hypervisors will issue a
+ warning when the first VM is started in a potentially
+ insecure configuration, i.e. SMT enabled or L1D flush
+ disabled.
+
+ full,force Same as 'full', but disables SMT and L1D flush runtime
+ control. Implies the 'nosmt=force' command line option.
+ (i.e. sysfs control of SMT is disabled.)
+
+ flush Leaves SMT enabled and enables the default hypervisor
+ mitigation, i.e. conditional L1D flushing
+
+ SMT control and L1D flush control via the sysfs interface
+ is still possible after boot. Hypervisors will issue a
+ warning when the first VM is started in a potentially
+ insecure configuration, i.e. SMT enabled or L1D flush
+ disabled.
+
+ flush,nosmt Disables SMT and enables the default hypervisor mitigation,
+ i.e. conditional L1D flushing.
+
+ SMT control and L1D flush control via the sysfs interface
+ is still possible after boot. Hypervisors will issue a
+ warning when the first VM is started in a potentially
+ insecure configuration, i.e. SMT enabled or L1D flush
+ disabled.
+
+ flush,nowarn Same as 'flush', but hypervisors will not warn when a VM is
+ started in a potentially insecure configuration.
+
+ off Disables hypervisor mitigations and doesn't emit any
+ warnings.
+ ============ =============================================================
+
+The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
+
+
+.. _mitigation_control_kvm:
+
+Mitigation control for KVM - module parameter
+-------------------------------------------------------------
+
+The KVM hypervisor mitigation mechanism, flushing the L1D cache when
+entering a guest, can be controlled with a module parameter.
+
+The option/parameter is "kvm-intel.vmentry_l1d_flush=". It takes the
+following arguments:
+
+ ============ ==============================================================
+ always L1D cache flush on every VMENTER.
+
+ cond Flush L1D on VMENTER only when the code between VMEXIT and
+ VMENTER can leak host memory which is considered
+ interesting for an attacker. This still can leak host memory
+ which allows e.g. to determine the hosts address space layout.
+
+ never Disables the mitigation
+ ============ ==============================================================
+
+The parameter can be provided on the kernel command line, as a module
+parameter when loading the modules and at runtime modified via the sysfs
+file:
+
+/sys/module/kvm_intel/parameters/vmentry_l1d_flush
+
+The default is 'cond'. If 'l1tf=full,force' is given on the kernel command
+line, then 'always' is enforced and the kvm-intel.vmentry_l1d_flush
+module parameter is ignored and writes to the sysfs file are rejected.
+
+
+Mitigation selection guide
+--------------------------
+
+1. No virtualization in use
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+ The system is protected by the kernel unconditionally and no further
+ action is required.
+
+2. Virtualization with trusted guests
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+ If the guest comes from a trusted source and the guest OS kernel is
+ guaranteed to have the L1TF mitigations in place the system is fully
+ protected against L1TF and no further action is required.
+
+ To avoid the overhead of the default L1D flushing on VMENTER the
+ administrator can disable the flushing via the kernel command line and
+ sysfs control files. See :ref:`mitigation_control_command_line` and
+ :ref:`mitigation_control_kvm`.
+
+
+3. Virtualization with untrusted guests
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+3.1. SMT not supported or disabled
+""""""""""""""""""""""""""""""""""
+
+ If SMT is not supported by the processor or disabled in the BIOS or by
+ the kernel, it's only required to enforce L1D flushing on VMENTER.
+
+ Conditional L1D flushing is the default behaviour and can be tuned. See
+ :ref:`mitigation_control_command_line` and :ref:`mitigation_control_kvm`.
+
+3.2. EPT not supported or disabled
+""""""""""""""""""""""""""""""""""
+
+ If EPT is not supported by the processor or disabled in the hypervisor,
+ the system is fully protected. SMT can stay enabled and L1D flushing on
+ VMENTER is not required.
+
+ EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter.
+
+3.3. SMT and EPT supported and active
+"""""""""""""""""""""""""""""""""""""
+
+ If SMT and EPT are supported and active then various degrees of
+ mitigations can be employed:
+
+ - L1D flushing on VMENTER:
+
+ L1D flushing on VMENTER is the minimal protection requirement, but it
+ is only potent in combination with other mitigation methods.
+
+ Conditional L1D flushing is the default behaviour and can be tuned. See
+ :ref:`mitigation_control_command_line` and :ref:`mitigation_control_kvm`.
+
+ - Guest confinement:
+
+ Confinement of guests to a single or a group of physical cores which
+ are not running any other processes, can reduce the attack surface
+ significantly, but interrupts, soft interrupts and kernel threads can
+ still expose valuable data to a potential attacker. See
+ :ref:`guest_confinement`.
+
+ - Interrupt isolation:
+
+ Isolating the guest CPUs from interrupts can reduce the attack surface
+ further, but still allows a malicious guest to explore a limited amount
+ of host physical memory. This can at least be used to gain knowledge
+ about the host address space layout. The interrupts which have a fixed
+ affinity to the CPUs which run the untrusted guests can depending on
+ the scenario still trigger soft interrupts and schedule kernel threads
+ which might expose valuable information. See
+ :ref:`interrupt_isolation`.
+
+The above three mitigation methods combined can provide protection to a
+certain degree, but the risk of the remaining attack surface has to be
+carefully analyzed. For full protection the following methods are
+available:
+
+ - Disabling SMT:
+
+ Disabling SMT and enforcing the L1D flushing provides the maximum
+ amount of protection. This mitigation is not depending on any of the
+ above mitigation methods.
+
+ SMT control and L1D flushing can be tuned by the command line
+ parameters 'nosmt', 'l1tf', 'kvm-intel.vmentry_l1d_flush' and at run
+ time with the matching sysfs control files. See :ref:`smt_control`,
+ :ref:`mitigation_control_command_line` and
+ :ref:`mitigation_control_kvm`.
+
+ - Disabling EPT:
+
+ Disabling EPT provides the maximum amount of protection as well. It is
+ not depending on any of the above mitigation methods. SMT can stay
+ enabled and L1D flushing is not required, but the performance impact is
+ significant.
+
+ EPT can be disabled in the hypervisor via the 'kvm-intel.ept'
+ parameter.
+
+
+.. _default_mitigations:
+
+Default mitigations
+-------------------
+
+ The kernel default mitigations for vulnerable processors are:
+
+ - PTE inversion to protect against malicious user space. This is done
+ unconditionally and cannot be controlled.
+
+ - L1D conditional flushing on VMENTER when EPT is enabled for
+ a guest.
+
+ The kernel does not by default enforce the disabling of SMT, which leaves
+ SMT systems vulnerable when running untrusted guests with EPT enabled.
+
+ The rationale for this choice is:
+
+ - Force disabling SMT can break existing setups, especially with
+ unattended updates.
+
+ - If regular users run untrusted guests on their machine, then L1TF is
+ just an add on to other malware which might be embedded in an untrusted
+ guest, e.g. spam-bots or attacks on the local network.
+
+ There is no technical way to prevent a user from running untrusted code
+ on their machines blindly.
+
+ - It's technically extremely unlikely and from today's knowledge even
+ impossible that L1TF can be exploited via the most popular attack
+ mechanisms like JavaScript because these mechanisms have no way to
+ control PTEs. If this would be possible and not other mitigation would
+ be possible, then the default might be different.
+
+ - The administrators of cloud and hosting setups have to carefully
+ analyze the risk for their scenarios and make the appropriate
+ mitigation choices, which might even vary across their deployed
+ machines and also result in other changes of their overall setup.
+ There is no way for the kernel to provide a sensible default for this
+ kind of scenarios.
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 080/107] x86/KVM/VMX: Initialize the vmx_l1d_flush_pages content
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 079/107] Documentation: Add section about CPU vulnerabilities Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 081/107] Documentation/l1tf: Fix typos Greg Kroah-Hartman
` (28 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolai Stange, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <nstange@suse.de>
commit 288d152c23dcf3c09da46c5c481903ca10ebfef7 upstream
The slow path in vmx_l1d_flush() reads from vmx_l1d_flush_pages in order
to evict the L1d cache.
However, these pages are never cleared and, in theory, their data could be
leaked.
More importantly, KSM could merge a nested hypervisor's vmx_l1d_flush_pages
to fewer than 1 << L1D_CACHE_ORDER host physical pages and this would break
the L1d flushing algorithm: L1D on x86_64 is tagged by physical addresses.
Fix this by initializing the individual vmx_l1d_flush_pages with a
different pattern each.
Rename the "empty_zp" asm constraint identifier in vmx_l1d_flush() to
"flush_pages" to reflect this change.
Fixes: a47dd5f06714 ("x86/KVM/VMX: Add L1D flush algorithm")
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -212,6 +212,7 @@ static void *vmx_l1d_flush_pages;
static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
{
struct page *page;
+ unsigned int i;
if (!enable_ept) {
l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED;
@@ -244,6 +245,16 @@ static int vmx_setup_l1d_flush(enum vmx_
if (!page)
return -ENOMEM;
vmx_l1d_flush_pages = page_address(page);
+
+ /*
+ * Initialize each page with a different pattern in
+ * order to protect against KSM in the nested
+ * virtualization case.
+ */
+ for (i = 0; i < 1u << L1D_CACHE_ORDER; ++i) {
+ memset(vmx_l1d_flush_pages + i * PAGE_SIZE, i + 1,
+ PAGE_SIZE);
+ }
}
l1tf_vmx_mitigation = l1tf;
@@ -8675,7 +8686,7 @@ static void vmx_l1d_flush(struct kvm_vcp
/* First ensure the pages are in the TLB */
"xorl %%eax, %%eax\n"
".Lpopulate_tlb:\n\t"
- "movzbl (%[empty_zp], %%" _ASM_AX "), %%ecx\n\t"
+ "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
"addl $4096, %%eax\n\t"
"cmpl %%eax, %[size]\n\t"
"jne .Lpopulate_tlb\n\t"
@@ -8684,12 +8695,12 @@ static void vmx_l1d_flush(struct kvm_vcp
/* Now fill the cache */
"xorl %%eax, %%eax\n"
".Lfill_cache:\n"
- "movzbl (%[empty_zp], %%" _ASM_AX "), %%ecx\n\t"
+ "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
"addl $64, %%eax\n\t"
"cmpl %%eax, %[size]\n\t"
"jne .Lfill_cache\n\t"
"lfence\n"
- :: [empty_zp] "r" (vmx_l1d_flush_pages),
+ :: [flush_pages] "r" (vmx_l1d_flush_pages),
[size] "r" (size)
: "eax", "ebx", "ecx", "edx");
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 081/107] Documentation/l1tf: Fix typos
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 080/107] x86/KVM/VMX: Initialize the vmx_l1d_flush_pages content Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 082/107] cpu/hotplug: detect SMT disabled by BIOS Greg Kroah-Hartman
` (27 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tony Luck, Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <tony.luck@intel.com>
commit 1949f9f49792d65dba2090edddbe36a5f02e3ba3 upstream
Fix spelling and other typos
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/l1tf.rst | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/Documentation/l1tf.rst
+++ b/Documentation/l1tf.rst
@@ -17,7 +17,7 @@ vulnerability is not present on:
- Older processor models, where the CPU family is < 6
- A range of Intel ATOM processors (Cedarview, Cloverview, Lincroft,
- Penwell, Pineview, Slivermont, Airmont, Merrifield)
+ Penwell, Pineview, Silvermont, Airmont, Merrifield)
- The Intel Core Duo Yonah variants (2006 - 2008)
@@ -113,7 +113,7 @@ Attack scenarios
deployment scenario. The mitigations, their protection scope and impact
are described in the next sections.
- The default mitigations and the rationale for chosing them are explained
+ The default mitigations and the rationale for choosing them are explained
at the end of this document. See :ref:`default_mitigations`.
.. _l1tf_sys_info:
@@ -191,15 +191,15 @@ Guest mitigation mechanisms
- unconditional ('always')
The conditional mode avoids L1D flushing after VMEXITs which execute
- only audited code pathes before the corresponding VMENTER. These code
- pathes have beed verified that they cannot expose secrets or other
+ only audited code paths before the corresponding VMENTER. These code
+ paths have been verified that they cannot expose secrets or other
interesting data to an attacker, but they can leak information about the
address space layout of the hypervisor.
Unconditional mode flushes L1D on all VMENTER invocations and provides
maximum protection. It has a higher overhead than the conditional
mode. The overhead cannot be quantified correctly as it depends on the
- work load scenario and the resulting number of VMEXITs.
+ workload scenario and the resulting number of VMEXITs.
The general recommendation is to enable L1D flush on VMENTER. The kernel
defaults to conditional mode on affected processors.
@@ -262,7 +262,7 @@ Guest mitigation mechanisms
Whether the interrupts with are affine to CPUs, which run untrusted
guests, provide interesting data for an attacker depends on the system
configuration and the scenarios which run on the system. While for some
- of the interrupts it can be assumed that they wont expose interesting
+ of the interrupts it can be assumed that they won't expose interesting
information beyond exposing hints about the host OS memory layout, there
is no way to make general assumptions.
@@ -299,7 +299,7 @@ Guest mitigation mechanisms
to be brought up at least partially and are then shut down
again. "nosmt" can be undone via the sysfs interface.
- nosmt=force Has the same effect as "nosmt' but it does not allow to
+ nosmt=force Has the same effect as "nosmt" but it does not allow to
undo the SMT disable via the sysfs interface.
=========== ==========================================================
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 082/107] cpu/hotplug: detect SMT disabled by BIOS
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 081/107] Documentation/l1tf: Fix typos Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 083/107] x86/KVM/VMX: Dont set l1tf_flush_l1d to true from vmx_l1d_flush() Greg Kroah-Hartman
` (26 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joe Mario, Jiri Kosina,
Josh Poimboeuf, Peter Zijlstra, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@redhat.com>
commit 73d5e2b472640b1fcdb61ae8be389912ef211bda upstream
If SMT is disabled in BIOS, the CPU code doesn't properly detect it.
The /sys/devices/system/cpu/smt/control file shows 'on', and the 'l1tf'
vulnerabilities file shows SMT as vulnerable.
Fix it by forcing 'cpu_smt_control' to CPU_SMT_NOT_SUPPORTED in such a
case. Unfortunately the detection can only be done after bringing all
the CPUs online, so we have to overwrite any previous writes to the
variable.
Reported-by: Joe Mario <jmario@redhat.com>
Tested-by: Jiri Kosina <jkosina@suse.cz>
Fixes: f048c399e0f7 ("x86/topology: Provide topology_smt_supported()")
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cpu.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -2063,6 +2063,15 @@ static const struct attribute_group cpuh
static int __init cpu_smt_state_init(void)
{
+ /*
+ * If SMT was disabled by BIOS, detect it here, after the CPUs have
+ * been brought online. This ensures the smt/l1tf sysfs entries are
+ * consistent with reality. Note this may overwrite cpu_smt_control's
+ * previous setting.
+ */
+ if (topology_max_smt_threads() == 1)
+ cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
+
return sysfs_create_group(&cpu_subsys.dev_root->kobj,
&cpuhp_smt_attr_group);
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 083/107] x86/KVM/VMX: Dont set l1tf_flush_l1d to true from vmx_l1d_flush()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 082/107] cpu/hotplug: detect SMT disabled by BIOS Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 084/107] x86/KVM/VMX: Replace vmx_l1d_flush_always with vmx_l1d_flush_cond Greg Kroah-Hartman
` (25 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolai Stange, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <nstange@suse.de>
commit 379fd0c7e6a391e5565336a646f19f218fb98c6c upstream
vmx_l1d_flush() gets invoked only if l1tf_flush_l1d is true. There's no
point in setting l1tf_flush_l1d to true from there again.
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8665,15 +8665,15 @@ static void vmx_l1d_flush(struct kvm_vcp
/*
* This code is only executed when the the flush mode is 'cond' or
* 'always'
- *
- * If 'flush always', keep the flush bit set, otherwise clear
- * it. The flush bit gets set again either from vcpu_run() or from
- * one of the unsafe VMEXIT handlers.
*/
- if (static_branch_unlikely(&vmx_l1d_flush_always))
- vcpu->arch.l1tf_flush_l1d = true;
- else
+ if (!static_branch_unlikely(&vmx_l1d_flush_always)) {
+ /*
+ * Clear the flush bit, it gets set again either from
+ * vcpu_run() or from one of the unsafe VMEXIT
+ * handlers.
+ */
vcpu->arch.l1tf_flush_l1d = false;
+ }
vcpu->stat.l1d_flush++;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 084/107] x86/KVM/VMX: Replace vmx_l1d_flush_always with vmx_l1d_flush_cond
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 083/107] x86/KVM/VMX: Dont set l1tf_flush_l1d to true from vmx_l1d_flush() Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 085/107] x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush() Greg Kroah-Hartman
` (24 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolai Stange, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <nstange@suse.de>
commit 427362a142441f08051369db6fbe7f61c73b3dca upstream
The vmx_l1d_flush_always static key is only ever evaluated if
vmx_l1d_should_flush is enabled. In that case however, there are only two
L1d flushing modes possible: "always" and "conditional".
The "conditional" mode's implementation tends to require more sophisticated
logic than the "always" mode.
Avoid inverted logic by replacing the 'vmx_l1d_flush_always' static key
with a 'vmx_l1d_flush_cond' one.
There is no change in functionality.
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -190,7 +190,7 @@ module_param(ple_window_max, int, S_IRUG
extern const ulong vmx_return;
static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
-static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_always);
+static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_cond);
static DEFINE_MUTEX(vmx_l1d_flush_mutex);
/* Storage for pre module init parameter parsing */
@@ -264,10 +264,10 @@ static int vmx_setup_l1d_flush(enum vmx_
else
static_branch_disable(&vmx_l1d_should_flush);
- if (l1tf == VMENTER_L1D_FLUSH_ALWAYS)
- static_branch_enable(&vmx_l1d_flush_always);
+ if (l1tf == VMENTER_L1D_FLUSH_COND)
+ static_branch_enable(&vmx_l1d_flush_cond);
else
- static_branch_disable(&vmx_l1d_flush_always);
+ static_branch_disable(&vmx_l1d_flush_cond);
return 0;
}
@@ -8666,7 +8666,7 @@ static void vmx_l1d_flush(struct kvm_vcp
* This code is only executed when the the flush mode is 'cond' or
* 'always'
*/
- if (!static_branch_unlikely(&vmx_l1d_flush_always)) {
+ if (static_branch_likely(&vmx_l1d_flush_cond)) {
/*
* Clear the flush bit, it gets set again either from
* vcpu_run() or from one of the unsafe VMEXIT
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 085/107] x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 084/107] x86/KVM/VMX: Replace vmx_l1d_flush_always with vmx_l1d_flush_cond Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 086/107] x86/irq: Demote irq_cpustat_t::__softirq_pending to u16 Greg Kroah-Hartman
` (23 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolai Stange, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <nstange@suse.de>
commit 5b6ccc6c3b1a477fbac9ec97a0b4c1c48e765209 upstream
Currently, vmx_vcpu_run() checks if l1tf_flush_l1d is set and invokes
vmx_l1d_flush() if so.
This test is unncessary for the "always flush L1D" mode.
Move the check to vmx_l1d_flush()'s conditional mode code path.
Notes:
- vmx_l1d_flush() is likely to get inlined anyway and thus, there's no
extra function call.
- This inverts the (static) branch prediction, but there hadn't been any
explicit likely()/unlikely() annotations before and so it stays as is.
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8667,12 +8667,16 @@ static void vmx_l1d_flush(struct kvm_vcp
* 'always'
*/
if (static_branch_likely(&vmx_l1d_flush_cond)) {
+ bool flush_l1d = vcpu->arch.l1tf_flush_l1d;
+
/*
* Clear the flush bit, it gets set again either from
* vcpu_run() or from one of the unsafe VMEXIT
* handlers.
*/
vcpu->arch.l1tf_flush_l1d = false;
+ if (!flush_l1d)
+ return;
}
vcpu->stat.l1d_flush++;
@@ -9162,10 +9166,8 @@ static void __noclone vmx_vcpu_run(struc
vmx->__launched = vmx->loaded_vmcs->launched;
- if (static_branch_unlikely(&vmx_l1d_should_flush)) {
- if (vcpu->arch.l1tf_flush_l1d)
- vmx_l1d_flush(vcpu);
- }
+ if (static_branch_unlikely(&vmx_l1d_should_flush))
+ vmx_l1d_flush(vcpu);
asm(
/* Store host registers */
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 086/107] x86/irq: Demote irq_cpustat_t::__softirq_pending to u16
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 085/107] x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush() Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 087/107] x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d Greg Kroah-Hartman
` (22 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Nicolai Stange,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <nstange@suse.de>
commit 9aee5f8a7e30330d0a8f4c626dc924ca5590aba5 upstream
An upcoming patch will extend KVM's L1TF mitigation in conditional mode
to also cover interrupts after VMEXITs. For tracking those, stores to a
new per-cpu flag from interrupt handlers will become necessary.
In order to improve cache locality, this new flag will be added to x86's
irq_cpustat_t.
Make some space available there by shrinking the ->softirq_pending bitfield
from 32 to 16 bits: the number of bits actually used is only NR_SOFTIRQS,
i.e. 10.
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/hardirq.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/include/asm/hardirq.h
+++ b/arch/x86/include/asm/hardirq.h
@@ -5,7 +5,7 @@
#include <linux/irq.h>
typedef struct {
- unsigned int __softirq_pending;
+ u16 __softirq_pending;
unsigned int __nmi_count; /* arch dependent */
#ifdef CONFIG_X86_LOCAL_APIC
unsigned int apic_timer_irqs; /* arch dependent */
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 087/107] x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 086/107] x86/irq: Demote irq_cpustat_t::__softirq_pending to u16 Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 088/107] x86: Dont include linux/irq.h from asm/hardirq.h Greg Kroah-Hartman
` (21 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Peter Zijlstra,
Nicolai Stange, Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <nstange@suse.de>
commit 45b575c00d8e72d69d75dd8c112f044b7b01b069 upstream
Part of the L1TF mitigation for vmx includes flushing the L1D cache upon
VMENTRY.
L1D flushes are costly and two modes of operations are provided to users:
"always" and the more selective "conditional" mode.
If operating in the latter, the cache would get flushed only if a host side
code path considered unconfined had been traversed. "Unconfined" in this
context means that it might have pulled in sensitive data like user data
or kernel crypto keys.
The need for L1D flushes is tracked by means of the per-vcpu flag
l1tf_flush_l1d. KVM exit handlers considered unconfined set it. A
vmx_l1d_flush() subsequently invoked before the next VMENTER will conduct a
L1d flush based on its value and reset that flag again.
Currently, interrupts delivered "normally" while in root operation between
VMEXIT and VMENTER are not taken into account. Part of the reason is that
these don't leave any traces and thus, the vmx code is unable to tell if
any such has happened.
As proposed by Paolo Bonzini, prepare for tracking all interrupts by
introducing a new per-cpu flag, "kvm_cpu_l1tf_flush_l1d". It will be in
strong analogy to the per-vcpu ->l1tf_flush_l1d.
A later patch will make interrupt handlers set it.
For the sake of cache locality, group kvm_cpu_l1tf_flush_l1d into x86'
per-cpu irq_cpustat_t as suggested by Peter Zijlstra.
Provide the helpers kvm_set_cpu_l1tf_flush_l1d(),
kvm_clear_cpu_l1tf_flush_l1d() and kvm_get_cpu_l1tf_flush_l1d(). Make them
trivial resp. non-existent for !CONFIG_KVM_INTEL as appropriate.
Let vmx_l1d_flush() handle kvm_cpu_l1tf_flush_l1d in the same way as
l1tf_flush_l1d.
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/hardirq.h | 23 +++++++++++++++++++++++
arch/x86/kvm/vmx.c | 17 +++++++++++++----
2 files changed, 36 insertions(+), 4 deletions(-)
--- a/arch/x86/include/asm/hardirq.h
+++ b/arch/x86/include/asm/hardirq.h
@@ -6,6 +6,9 @@
typedef struct {
u16 __softirq_pending;
+#if IS_ENABLED(CONFIG_KVM_INTEL)
+ u8 kvm_cpu_l1tf_flush_l1d;
+#endif
unsigned int __nmi_count; /* arch dependent */
#ifdef CONFIG_X86_LOCAL_APIC
unsigned int apic_timer_irqs; /* arch dependent */
@@ -60,4 +63,24 @@ extern u64 arch_irq_stat_cpu(unsigned in
extern u64 arch_irq_stat(void);
#define arch_irq_stat arch_irq_stat
+
+#if IS_ENABLED(CONFIG_KVM_INTEL)
+static inline void kvm_set_cpu_l1tf_flush_l1d(void)
+{
+ __this_cpu_write(irq_stat.kvm_cpu_l1tf_flush_l1d, 1);
+}
+
+static inline void kvm_clear_cpu_l1tf_flush_l1d(void)
+{
+ __this_cpu_write(irq_stat.kvm_cpu_l1tf_flush_l1d, 0);
+}
+
+static inline bool kvm_get_cpu_l1tf_flush_l1d(void)
+{
+ return __this_cpu_read(irq_stat.kvm_cpu_l1tf_flush_l1d);
+}
+#else /* !IS_ENABLED(CONFIG_KVM_INTEL) */
+static inline void kvm_set_cpu_l1tf_flush_l1d(void) { }
+#endif /* IS_ENABLED(CONFIG_KVM_INTEL) */
+
#endif /* _ASM_X86_HARDIRQ_H */
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8667,14 +8667,23 @@ static void vmx_l1d_flush(struct kvm_vcp
* 'always'
*/
if (static_branch_likely(&vmx_l1d_flush_cond)) {
- bool flush_l1d = vcpu->arch.l1tf_flush_l1d;
+ bool flush_l1d;
/*
- * Clear the flush bit, it gets set again either from
- * vcpu_run() or from one of the unsafe VMEXIT
- * handlers.
+ * Clear the per-vcpu flush bit, it gets set again
+ * either from vcpu_run() or from one of the unsafe
+ * VMEXIT handlers.
*/
+ flush_l1d = vcpu->arch.l1tf_flush_l1d;
vcpu->arch.l1tf_flush_l1d = false;
+
+ /*
+ * Clear the per-cpu flush bit, it gets set again from
+ * the interrupt handlers.
+ */
+ flush_l1d |= kvm_get_cpu_l1tf_flush_l1d();
+ kvm_clear_cpu_l1tf_flush_l1d();
+
if (!flush_l1d)
return;
}
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 088/107] x86: Dont include linux/irq.h from asm/hardirq.h
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 087/107] x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 089/107] x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d Greg Kroah-Hartman
` (20 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolai Stange, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <nstange@suse.de>
commit 447ae316670230d7d29430e2cbf1f5db4f49d14c upstream
The next patch in this series will have to make the definition of
irq_cpustat_t available to entering_irq().
Inclusion of asm/hardirq.h into asm/apic.h would cause circular header
dependencies like
asm/smp.h
asm/apic.h
asm/hardirq.h
linux/irq.h
linux/topology.h
linux/smp.h
asm/smp.h
or
linux/gfp.h
linux/mmzone.h
asm/mmzone.h
asm/mmzone_64.h
asm/smp.h
asm/apic.h
asm/hardirq.h
linux/irq.h
linux/irqdesc.h
linux/kobject.h
linux/sysfs.h
linux/kernfs.h
linux/idr.h
linux/gfp.h
and others.
This causes compilation errors because of the header guards becoming
effective in the second inclusion: symbols/macros that had been defined
before wouldn't be available to intermediate headers in the #include chain
anymore.
A possible workaround would be to move the definition of irq_cpustat_t
into its own header and include that from both, asm/hardirq.h and
asm/apic.h.
However, this wouldn't solve the real problem, namely asm/harirq.h
unnecessarily pulling in all the linux/irq.h cruft: nothing in
asm/hardirq.h itself requires it. Also, note that there are some other
archs, like e.g. arm64, which don't have that #include in their
asm/hardirq.h.
Remove the linux/irq.h #include from x86' asm/hardirq.h.
Fix resulting compilation errors by adding appropriate #includes to *.c
files as needed.
Note that some of these *.c files could be cleaned up a bit wrt. to their
set of #includes, but that should better be done from separate patches, if
at all.
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[dwmw2: More fixes for EFI and Xen in 4.9]
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/dmi.h | 2 +-
arch/x86/include/asm/hardirq.h | 1 -
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/kernel/apic/apic.c | 2 ++
arch/x86/kernel/apic/htirq.c | 2 ++
arch/x86/kernel/apic/io_apic.c | 1 +
arch/x86/kernel/apic/msi.c | 1 +
arch/x86/kernel/apic/vector.c | 1 +
arch/x86/kernel/fpu/core.c | 1 +
arch/x86/kernel/ftrace.c | 1 +
arch/x86/kernel/hpet.c | 1 +
arch/x86/kernel/i8259.c | 1 +
arch/x86/kernel/irq.c | 1 +
arch/x86/kernel/irq_32.c | 1 +
arch/x86/kernel/irq_64.c | 1 +
arch/x86/kernel/irqinit.c | 1 +
arch/x86/kernel/kprobes/core.c | 1 +
arch/x86/kernel/kprobes/opt.c | 1 +
arch/x86/kernel/smpboot.c | 1 +
arch/x86/kernel/time.c | 1 +
arch/x86/mm/fault.c | 1 +
arch/x86/mm/kaiser.c | 1 +
arch/x86/platform/efi/efi_64.c | 1 +
arch/x86/platform/efi/quirks.c | 1 +
arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c | 1 +
arch/x86/xen/enlighten.c | 1 +
arch/x86/xen/setup.c | 1 +
drivers/pci/host/pci-hyperv.c | 2 ++
28 files changed, 30 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/dmi.h
+++ b/arch/x86/include/asm/dmi.h
@@ -3,8 +3,8 @@
#include <linux/compiler.h>
#include <linux/init.h>
+#include <linux/io.h>
-#include <asm/io.h>
#include <asm/setup.h>
static __always_inline __init void *dmi_alloc(unsigned len)
--- a/arch/x86/include/asm/hardirq.h
+++ b/arch/x86/include/asm/hardirq.h
@@ -2,7 +2,6 @@
#define _ASM_X86_HARDIRQ_H
#include <linux/threads.h>
-#include <linux/irq.h>
typedef struct {
u16 __softirq_pending;
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -17,6 +17,7 @@
#include <linux/tracepoint.h>
#include <linux/cpumask.h>
#include <linux/irq_work.h>
+#include <linux/irq.h>
#include <linux/kvm.h>
#include <linux/kvm_para.h>
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -34,6 +34,7 @@
#include <linux/dmi.h>
#include <linux/smp.h>
#include <linux/mm.h>
+#include <linux/irq.h>
#include <asm/trace/irq_vectors.h>
#include <asm/irq_remapping.h>
@@ -55,6 +56,7 @@
#include <asm/mce.h>
#include <asm/tsc.h>
#include <asm/hypervisor.h>
+#include <asm/irq_regs.h>
unsigned int num_processors;
--- a/arch/x86/kernel/apic/htirq.c
+++ b/arch/x86/kernel/apic/htirq.c
@@ -16,6 +16,8 @@
#include <linux/device.h>
#include <linux/pci.h>
#include <linux/htirq.h>
+#include <linux/irq.h>
+
#include <asm/irqdomain.h>
#include <asm/hw_irq.h>
#include <asm/apic.h>
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -32,6 +32,7 @@
#include <linux/mm.h>
#include <linux/interrupt.h>
+#include <linux/irq.h>
#include <linux/init.h>
#include <linux/delay.h>
#include <linux/sched.h>
--- a/arch/x86/kernel/apic/msi.c
+++ b/arch/x86/kernel/apic/msi.c
@@ -12,6 +12,7 @@
*/
#include <linux/mm.h>
#include <linux/interrupt.h>
+#include <linux/irq.h>
#include <linux/pci.h>
#include <linux/dmar.h>
#include <linux/hpet.h>
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -11,6 +11,7 @@
* published by the Free Software Foundation.
*/
#include <linux/interrupt.h>
+#include <linux/irq.h>
#include <linux/init.h>
#include <linux/compiler.h>
#include <linux/slab.h>
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -10,6 +10,7 @@
#include <asm/fpu/signal.h>
#include <asm/fpu/types.h>
#include <asm/traps.h>
+#include <asm/irq_regs.h>
#include <linux/hardirq.h>
#include <linux/pkeys.h>
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -26,6 +26,7 @@
#include <asm/cacheflush.h>
#include <asm/kprobes.h>
+#include <asm/sections.h>
#include <asm/ftrace.h>
#include <asm/nops.h>
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -1,6 +1,7 @@
#include <linux/clocksource.h>
#include <linux/clockchips.h>
#include <linux/interrupt.h>
+#include <linux/irq.h>
#include <linux/export.h>
#include <linux/delay.h>
#include <linux/errno.h>
--- a/arch/x86/kernel/i8259.c
+++ b/arch/x86/kernel/i8259.c
@@ -4,6 +4,7 @@
#include <linux/sched.h>
#include <linux/ioport.h>
#include <linux/interrupt.h>
+#include <linux/irq.h>
#include <linux/timex.h>
#include <linux/random.h>
#include <linux/init.h>
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -10,6 +10,7 @@
#include <linux/ftrace.h>
#include <linux/delay.h>
#include <linux/export.h>
+#include <linux/irq.h>
#include <asm/apic.h>
#include <asm/io_apic.h>
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -10,6 +10,7 @@
#include <linux/seq_file.h>
#include <linux/interrupt.h>
+#include <linux/irq.h>
#include <linux/kernel_stat.h>
#include <linux/notifier.h>
#include <linux/cpu.h>
--- a/arch/x86/kernel/irq_64.c
+++ b/arch/x86/kernel/irq_64.c
@@ -10,6 +10,7 @@
#include <linux/kernel_stat.h>
#include <linux/interrupt.h>
+#include <linux/irq.h>
#include <linux/seq_file.h>
#include <linux/delay.h>
#include <linux/ftrace.h>
--- a/arch/x86/kernel/irqinit.c
+++ b/arch/x86/kernel/irqinit.c
@@ -4,6 +4,7 @@
#include <linux/sched.h>
#include <linux/ioport.h>
#include <linux/interrupt.h>
+#include <linux/irq.h>
#include <linux/timex.h>
#include <linux/random.h>
#include <linux/kprobes.h>
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -61,6 +61,7 @@
#include <asm/alternative.h>
#include <asm/insn.h>
#include <asm/debugreg.h>
+#include <asm/sections.h>
#include "common.h"
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -39,6 +39,7 @@
#include <asm/insn.h>
#include <asm/debugreg.h>
#include <asm/nospec-branch.h>
+#include <asm/sections.h>
#include "common.h"
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -76,6 +76,7 @@
#include <asm/realmode.h>
#include <asm/misc.h>
#include <asm/spec-ctrl.h>
+#include <asm/hw_irq.h>
/* Number of siblings per CPU package */
int smp_num_siblings = 1;
--- a/arch/x86/kernel/time.c
+++ b/arch/x86/kernel/time.c
@@ -11,6 +11,7 @@
#include <linux/clockchips.h>
#include <linux/interrupt.h>
+#include <linux/irq.h>
#include <linux/i8253.h>
#include <linux/time.h>
#include <linux/export.h>
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -23,6 +23,7 @@
#include <asm/vsyscall.h> /* emulate_vsyscall */
#include <asm/vm86.h> /* struct vm86 */
#include <asm/mmu_context.h> /* vma_pkey() */
+#include <asm/sections.h>
#define CREATE_TRACE_POINTS
#include <asm/trace/exceptions.h>
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -20,6 +20,7 @@
#include <asm/desc.h>
#include <asm/cmdline.h>
#include <asm/vsyscall.h>
+#include <asm/sections.h>
int kaiser_enabled __read_mostly = 1;
EXPORT_SYMBOL(kaiser_enabled); /* for inlined TLB flush functions */
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -45,6 +45,7 @@
#include <asm/realmode.h>
#include <asm/time.h>
#include <asm/pgalloc.h>
+#include <asm/sections.h>
/*
* We allocate runtime services regions bottom-up, starting from -4G, i.e.
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -13,6 +13,7 @@
#include <linux/dmi.h>
#include <asm/efi.h>
#include <asm/uv/uv.h>
+#include <asm/sections.h>
#define EFI_MIN_RESERVE 5120
--- a/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c
@@ -18,6 +18,7 @@
#include <asm/intel-mid.h>
#include <asm/intel_scu_ipc.h>
#include <asm/io_apic.h>
+#include <asm/hw_irq.h>
#define TANGIER_EXT_TIMER0_MSI 12
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -35,6 +35,7 @@
#include <linux/frame.h>
#include <linux/kexec.h>
+#include <linux/slab.h>
#include <xen/xen.h>
#include <xen/events.h>
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -18,6 +18,7 @@
#include <asm/setup.h>
#include <asm/acpi.h>
#include <asm/numa.h>
+#include <asm/sections.h>
#include <asm/xen/hypervisor.h>
#include <asm/xen/hypercall.h>
--- a/drivers/pci/host/pci-hyperv.c
+++ b/drivers/pci/host/pci-hyperv.c
@@ -52,6 +52,8 @@
#include <linux/pci.h>
#include <linux/semaphore.h>
#include <linux/irqdomain.h>
+#include <linux/irq.h>
+
#include <asm/irqdomain.h>
#include <asm/apic.h>
#include <linux/msi.h>
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 089/107] x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 088/107] x86: Dont include linux/irq.h from asm/hardirq.h Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 090/107] x86/KVM/VMX: Dont set l1tf_flush_l1d from vmx_handle_external_intr() Greg Kroah-Hartman
` (19 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Nicolai Stange,
Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <nstange@suse.de>
commit ffcba43ff66c7dab34ec700debd491d2a4d319b4 upstream
The last missing piece to having vmx_l1d_flush() take interrupts after
VMEXIT into account is to set the kvm_cpu_l1tf_flush_l1d per-cpu flag on
irq entry.
Issue calls to kvm_set_cpu_l1tf_flush_l1d() from entering_irq(),
ipi_entering_ack_irq(), smp_reschedule_interrupt() and
uv_bau_message_interrupt().
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/apic.h | 3 +++
arch/x86/kernel/smp.c | 1 +
arch/x86/platform/uv/tlb_uv.c | 1 +
3 files changed, 5 insertions(+)
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -12,6 +12,7 @@
#include <asm/mpspec.h>
#include <asm/msr.h>
#include <asm/idle.h>
+#include <asm/hardirq.h>
#define ARCH_APICTIMER_STOPS_ON_C3 1
@@ -647,6 +648,7 @@ static inline void entering_irq(void)
{
irq_enter();
exit_idle();
+ kvm_set_cpu_l1tf_flush_l1d();
}
static inline void entering_ack_irq(void)
@@ -659,6 +661,7 @@ static inline void ipi_entering_ack_irq(
{
irq_enter();
ack_APIC_irq();
+ kvm_set_cpu_l1tf_flush_l1d();
}
static inline void exiting_irq(void)
--- a/arch/x86/kernel/smp.c
+++ b/arch/x86/kernel/smp.c
@@ -271,6 +271,7 @@ __visible void __irq_entry smp_reschedul
/*
* KVM uses this interrupt to force a cpu out of guest mode
*/
+ kvm_set_cpu_l1tf_flush_l1d();
}
__visible void __irq_entry smp_trace_reschedule_interrupt(struct pt_regs *regs)
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1283,6 +1283,7 @@ void uv_bau_message_interrupt(struct pt_
struct msg_desc msgdesc;
ack_APIC_irq();
+ kvm_set_cpu_l1tf_flush_l1d();
time_start = get_cycles();
bcp = &per_cpu(bau_control, smp_processor_id());
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 090/107] x86/KVM/VMX: Dont set l1tf_flush_l1d from vmx_handle_external_intr()
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 089/107] x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 091/107] Documentation/l1tf: Remove Yonah processors from not vulnerable list Greg Kroah-Hartman
` (18 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolai Stange, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <nstange@suse.de>
commit 18b57ce2eb8c8b9a24174a89250cf5f57c76ecdc upstream
For VMEXITs caused by external interrupts, vmx_handle_external_intr()
indirectly calls into the interrupt handlers through the host's IDT.
It follows that these interrupts get accounted for in the
kvm_cpu_l1tf_flush_l1d per-cpu flag.
The subsequently executed vmx_l1d_flush() will thus be aware that some
interrupts have happened and conduct a L1d flush anyway.
Setting l1tf_flush_l1d from vmx_handle_external_intr() isn't needed
anymore. Drop it.
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 1 -
1 file changed, 1 deletion(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8929,7 +8929,6 @@ static void vmx_handle_external_intr(str
[ss]"i"(__KERNEL_DS),
[cs]"i"(__KERNEL_CS)
);
- vcpu->arch.l1tf_flush_l1d = true;
}
}
STACK_FRAME_NON_STANDARD(vmx_handle_external_intr);
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 091/107] Documentation/l1tf: Remove Yonah processors from not vulnerable list
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 090/107] x86/KVM/VMX: Dont set l1tf_flush_l1d from vmx_handle_external_intr() Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:17 ` [PATCH 4.9 096/107] KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR Greg Kroah-Hartman
` (17 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, ave Hansen, Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 58331136136935c631c2b5f06daf4c3006416e91 upstream
Dave reported, that it's not confirmed that Yonah processors are
unaffected. Remove them from the list.
Reported-by: ave Hansen <dave.hansen@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/l1tf.rst | 2 --
1 file changed, 2 deletions(-)
--- a/Documentation/l1tf.rst
+++ b/Documentation/l1tf.rst
@@ -19,8 +19,6 @@ vulnerability is not present on:
- A range of Intel ATOM processors (Cedarview, Cloverview, Lincroft,
Penwell, Pineview, Silvermont, Airmont, Merrifield)
- - The Intel Core Duo Yonah variants (2006 - 2008)
-
- The Intel XEON PHI family
- Intel processors which have the ARCH_CAP_RDCL_NO bit set in the
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 096/107] KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 091/107] Documentation/l1tf: Remove Yonah processors from not vulnerable list Greg Kroah-Hartman
@ 2018-08-14 17:17 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 097/107] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability Greg Kroah-Hartman
` (16 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit cd28325249a1ca0d771557ce823e0308ad629f98 upstream
This lets userspace read the MSR_IA32_ARCH_CAPABILITIES and check that all
requested features are available on the host.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/x86.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1015,6 +1015,7 @@ static unsigned num_emulated_msrs;
static u32 msr_based_features[] = {
MSR_F10H_DECFG,
MSR_IA32_UCODE_REV,
+ MSR_IA32_ARCH_CAPABILITIES,
};
static unsigned int num_msr_based_features;
@@ -1023,7 +1024,8 @@ static int kvm_get_msr_feature(struct kv
{
switch (msr->index) {
case MSR_IA32_UCODE_REV:
- rdmsrl(msr->index, msr->data);
+ case MSR_IA32_ARCH_CAPABILITIES:
+ rdmsrl_safe(msr->index, &msr->data);
break;
default:
if (kvm_x86_ops->get_msr_feature(msr))
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 097/107] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2018-08-14 17:17 ` [PATCH 4.9 096/107] KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 098/107] x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry Greg Kroah-Hartman
` (15 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit ea156d192f5257a5bf393d33910d3b481bf8a401 upstream
Three changes to the content of the sysfs file:
- If EPT is disabled, L1TF cannot be exploited even across threads on the
same core, and SMT is irrelevant.
- If mitigation is completely disabled, and SMT is enabled, print "vulnerable"
instead of "vulnerable, SMT vulnerable"
- Reorder the two parts so that the main vulnerability state comes first
and the detail on SMT is second.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/bugs.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -737,9 +737,15 @@ static ssize_t l1tf_show_state(char *buf
if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO)
return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
- return sprintf(buf, "%s; VMX: SMT %s, L1D %s\n", L1TF_DEFAULT_MSG,
- cpu_smt_control == CPU_SMT_ENABLED ? "vulnerable" : "disabled",
- l1tf_vmx_states[l1tf_vmx_mitigation]);
+ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED ||
+ (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER &&
+ cpu_smt_control == CPU_SMT_ENABLED))
+ return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
+ l1tf_vmx_states[l1tf_vmx_mitigation]);
+
+ return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
+ l1tf_vmx_states[l1tf_vmx_mitigation],
+ cpu_smt_control == CPU_SMT_ENABLED ? "vulnerable" : "disabled");
}
#else
static ssize_t l1tf_show_state(char *buf)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 098/107] x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 097/107] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 099/107] KVM: VMX: Tell the nested hypervisor " Greg Kroah-Hartman
` (14 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 8e0b2b916662e09dd4d09e5271cdf214c6b80e62 upstream
Bit 3 of ARCH_CAPABILITIES tells a hypervisor that L1D flush on vmentry is
not needed. Add a new value to enum vmx_l1d_flush_state, which is used
either if there is no L1TF bug at all, or if bit 3 is set in ARCH_CAPABILITIES.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/msr-index.h | 1 +
arch/x86/include/asm/vmx.h | 1 +
arch/x86/kernel/cpu/bugs.c | 1 +
arch/x86/kvm/vmx.c | 10 ++++++++++
4 files changed, 13 insertions(+)
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -63,6 +63,7 @@
#define MSR_IA32_ARCH_CAPABILITIES 0x0000010a
#define ARCH_CAP_RDCL_NO (1 << 0) /* Not susceptible to Meltdown */
#define ARCH_CAP_IBRS_ALL (1 << 1) /* Enhanced IBRS support */
+#define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH (1 << 3) /* Skip L1D flush on vmentry */
#define ARCH_CAP_SSB_NO (1 << 4) /*
* Not susceptible to Speculative Store Bypass
* attack, so no Speculative Store Bypass
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -505,6 +505,7 @@ enum vmx_l1d_flush_state {
VMENTER_L1D_FLUSH_COND,
VMENTER_L1D_FLUSH_ALWAYS,
VMENTER_L1D_FLUSH_EPT_DISABLED,
+ VMENTER_L1D_FLUSH_NOT_REQUIRED,
};
extern enum vmx_l1d_flush_state l1tf_vmx_mitigation;
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -730,6 +730,7 @@ static const char *l1tf_vmx_states[] = {
[VMENTER_L1D_FLUSH_COND] = "conditional cache flushes",
[VMENTER_L1D_FLUSH_ALWAYS] = "cache flushes",
[VMENTER_L1D_FLUSH_EPT_DISABLED] = "EPT disabled",
+ [VMENTER_L1D_FLUSH_NOT_REQUIRED] = "flush not necessary"
};
static ssize_t l1tf_show_state(char *buf)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -219,6 +219,16 @@ static int vmx_setup_l1d_flush(enum vmx_
return 0;
}
+ if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) {
+ u64 msr;
+
+ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr);
+ if (msr & ARCH_CAP_SKIP_VMENTRY_L1DFLUSH) {
+ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED;
+ return 0;
+ }
+ }
+
/* If set to auto use the default l1tf mitigation method */
if (l1tf == VMENTER_L1D_FLUSH_AUTO) {
switch (l1tf_mitigation) {
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 099/107] KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 098/107] x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 100/107] cpu/hotplug: Fix SMT supported evaluation Greg Kroah-Hartman
` (13 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 5b76a3cff011df2dcb6186c965a2e4d809a05ad4 upstream
When nested virtualization is in use, VMENTER operations from the nested
hypervisor into the nested guest will always be processed by the bare metal
hypervisor, and KVM's "conditional cache flushes" mode in particular does a
flush on nested vmentry. Therefore, include the "skip L1D flush on
vmentry" bit in KVM's suggested ARCH_CAPABILITIES setting.
Add the relevant Documentation.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/l1tf.rst | 21 +++++++++++++++++++++
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/kvm/vmx.c | 3 +--
arch/x86/kvm/x86.c | 26 +++++++++++++++++++++++++-
4 files changed, 48 insertions(+), 3 deletions(-)
--- a/Documentation/l1tf.rst
+++ b/Documentation/l1tf.rst
@@ -546,6 +546,27 @@ available:
EPT can be disabled in the hypervisor via the 'kvm-intel.ept'
parameter.
+3.4. Nested virtual machines
+""""""""""""""""""""""""""""
+
+When nested virtualization is in use, three operating systems are involved:
+the bare metal hypervisor, the nested hypervisor and the nested virtual
+machine. VMENTER operations from the nested hypervisor into the nested
+guest will always be processed by the bare metal hypervisor. If KVM is the
+bare metal hypervisor it wiil:
+
+ - Flush the L1D cache on every switch from the nested hypervisor to the
+ nested virtual machine, so that the nested hypervisor's secrets are not
+ exposed to the nested virtual machine;
+
+ - Flush the L1D cache on every switch from the nested virtual machine to
+ the nested hypervisor; this is a complex operation, and flushing the L1D
+ cache avoids that the bare metal hypervisor's secrets are exposed to the
+ nested virtual machine;
+
+ - Instruct the nested hypervisor to not perform any L1D cache flush. This
+ is an optimization to avoid double L1D flushing.
+
.. _default_mitigations:
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1346,6 +1346,7 @@ void kvm_vcpu_reload_apic_access_page(st
void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
unsigned long address);
+u64 kvm_get_arch_capabilities(void);
void kvm_define_shared_msr(unsigned index, u32 msr);
int kvm_set_shared_msr(unsigned index, u64 val, u64 mask);
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5461,8 +5461,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
++vmx->nmsrs;
}
- if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES))
- rdmsrl(MSR_IA32_ARCH_CAPABILITIES, vmx->arch_capabilities);
+ vmx->arch_capabilities = kvm_get_arch_capabilities();
vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl);
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1020,11 +1020,35 @@ static u32 msr_based_features[] = {
static unsigned int num_msr_based_features;
+u64 kvm_get_arch_capabilities(void)
+{
+ u64 data;
+
+ rdmsrl_safe(MSR_IA32_ARCH_CAPABILITIES, &data);
+
+ /*
+ * If we're doing cache flushes (either "always" or "cond")
+ * we will do one whenever the guest does a vmlaunch/vmresume.
+ * If an outer hypervisor is doing the cache flush for us
+ * (VMENTER_L1D_FLUSH_NESTED_VM), we can safely pass that
+ * capability to the guest too, and if EPT is disabled we're not
+ * vulnerable. Overall, only VMENTER_L1D_FLUSH_NEVER will
+ * require a nested hypervisor to do a flush of its own.
+ */
+ if (l1tf_vmx_mitigation != VMENTER_L1D_FLUSH_NEVER)
+ data |= ARCH_CAP_SKIP_VMENTRY_L1DFLUSH;
+
+ return data;
+}
+EXPORT_SYMBOL_GPL(kvm_get_arch_capabilities);
+
static int kvm_get_msr_feature(struct kvm_msr_entry *msr)
{
switch (msr->index) {
- case MSR_IA32_UCODE_REV:
case MSR_IA32_ARCH_CAPABILITIES:
+ msr->data = kvm_get_arch_capabilities();
+ break;
+ case MSR_IA32_UCODE_REV:
rdmsrl_safe(msr->index, &msr->data);
break;
default:
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 100/107] cpu/hotplug: Fix SMT supported evaluation
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 099/107] KVM: VMX: Tell the nested hypervisor " Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 101/107] x86/speculation/l1tf: Invert all not present mappings Greg Kroah-Hartman
` (12 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josh Poimboeuf, Thomas Gleixner,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit bc2d8d262cba5736332cbc866acb11b1c5748aa9 upstream
Josh reported that the late SMT evaluation in cpu_smt_state_init() sets
cpu_smt_control to CPU_SMT_NOT_SUPPORTED in case that 'nosmt' was supplied
on the kernel command line as it cannot differentiate between SMT disabled
by BIOS and SMT soft disable via 'nosmt'. That wreckages the state and
makes the sysfs interface unusable.
Rework this so that during bringup of the non boot CPUs the availability of
SMT is determined in cpu_smt_allowed(). If a newly booted CPU is not a
'primary' thread then set the local cpu_smt_available marker and evaluate
this explicitely right after the initial SMP bringup has finished.
SMT evaulation on x86 is a trainwreck as the firmware has all the
information _before_ booting the kernel, but there is no interface to query
it.
Fixes: 73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS")
Reported-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/bugs.c | 2 +-
include/linux/cpu.h | 2 ++
kernel/cpu.c | 41 ++++++++++++++++++++++++++++-------------
kernel/smp.c | 2 ++
4 files changed, 33 insertions(+), 14 deletions(-)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -61,7 +61,7 @@ void __init check_bugs(void)
* identify_boot_cpu() initialized SMT support information, let the
* core code know.
*/
- cpu_smt_check_topology();
+ cpu_smt_check_topology_early();
if (!IS_ENABLED(CONFIG_SMP)) {
pr_info("CPU: ");
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -267,10 +267,12 @@ enum cpuhp_smt_control {
#if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
extern enum cpuhp_smt_control cpu_smt_control;
extern void cpu_smt_disable(bool force);
+extern void cpu_smt_check_topology_early(void);
extern void cpu_smt_check_topology(void);
#else
# define cpu_smt_control (CPU_SMT_ENABLED)
static inline void cpu_smt_disable(bool force) { }
+static inline void cpu_smt_check_topology_early(void) { }
static inline void cpu_smt_check_topology(void) { }
#endif
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -360,6 +360,8 @@ EXPORT_SYMBOL_GPL(cpu_hotplug_enable);
enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
EXPORT_SYMBOL_GPL(cpu_smt_control);
+static bool cpu_smt_available __read_mostly;
+
void __init cpu_smt_disable(bool force)
{
if (cpu_smt_control == CPU_SMT_FORCE_DISABLED ||
@@ -376,14 +378,28 @@ void __init cpu_smt_disable(bool force)
/*
* The decision whether SMT is supported can only be done after the full
- * CPU identification. Called from architecture code.
+ * CPU identification. Called from architecture code before non boot CPUs
+ * are brought up.
*/
-void __init cpu_smt_check_topology(void)
+void __init cpu_smt_check_topology_early(void)
{
if (!topology_smt_supported())
cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
}
+/*
+ * If SMT was disabled by BIOS, detect it here, after the CPUs have been
+ * brought online. This ensures the smt/l1tf sysfs entries are consistent
+ * with reality. cpu_smt_available is set to true during the bringup of non
+ * boot CPUs when a SMT sibling is detected. Note, this may overwrite
+ * cpu_smt_control's previous setting.
+ */
+void __init cpu_smt_check_topology(void)
+{
+ if (!cpu_smt_available)
+ cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
+}
+
static int __init smt_cmdline_disable(char *str)
{
cpu_smt_disable(str && !strcmp(str, "force"));
@@ -393,10 +409,18 @@ early_param("nosmt", smt_cmdline_disable
static inline bool cpu_smt_allowed(unsigned int cpu)
{
- if (cpu_smt_control == CPU_SMT_ENABLED)
+ if (topology_is_primary_thread(cpu))
return true;
- if (topology_is_primary_thread(cpu))
+ /*
+ * If the CPU is not a 'primary' thread and the booted_once bit is
+ * set then the processor has SMT support. Store this information
+ * for the late check of SMT support in cpu_smt_check_topology().
+ */
+ if (per_cpu(cpuhp_state, cpu).booted_once)
+ cpu_smt_available = true;
+
+ if (cpu_smt_control == CPU_SMT_ENABLED)
return true;
/*
@@ -2063,15 +2087,6 @@ static const struct attribute_group cpuh
static int __init cpu_smt_state_init(void)
{
- /*
- * If SMT was disabled by BIOS, detect it here, after the CPUs have
- * been brought online. This ensures the smt/l1tf sysfs entries are
- * consistent with reality. Note this may overwrite cpu_smt_control's
- * previous setting.
- */
- if (topology_max_smt_threads() == 1)
- cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
-
return sysfs_create_group(&cpu_subsys.dev_root->kobj,
&cpuhp_smt_attr_group);
}
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -564,6 +564,8 @@ void __init smp_init(void)
cpu_up(cpu);
}
+ /* Final decision about SMT support */
+ cpu_smt_check_topology();
/* Any cleanup work */
smp_announce();
smp_cpus_done(setup_max_cpus);
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 101/107] x86/speculation/l1tf: Invert all not present mappings
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 100/107] cpu/hotplug: Fix SMT supported evaluation Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 102/107] x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert Greg Kroah-Hartman
` (11 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit f22cc87f6c1f771b57c407555cfefd811cdd9507 upstream
For kernel mappings PAGE_PROTNONE is not necessarily set for a non present
mapping, but the inversion logic explicitely checks for !PRESENT and
PROT_NONE.
Remove the PROT_NONE check and make the inversion unconditional for all not
present mappings.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable-invert.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/include/asm/pgtable-invert.h
+++ b/arch/x86/include/asm/pgtable-invert.h
@@ -6,7 +6,7 @@
static inline bool __pte_needs_invert(u64 val)
{
- return (val & (_PAGE_PRESENT|_PAGE_PROTNONE)) == _PAGE_PROTNONE;
+ return !(val & _PAGE_PRESENT);
}
/* Get a mask to xor with the page table entry to get the correct pfn. */
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 102/107] x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 101/107] x86/speculation/l1tf: Invert all not present mappings Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 103/107] x86/mm/pat: Make set_memory_np() L1TF safe Greg Kroah-Hartman
` (10 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit 0768f91530ff46683e0b372df14fd79fe8d156e5 upstream
Some cases in THP like:
- MADV_FREE
- mprotect
- split
mark the PMD non present for temporarily to prevent races. The window for
an L1TF attack in these contexts is very small, but it wants to be fixed
for correctness sake.
Use the proper low level functions for pmd/pud_mknotpresent() to address
this.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable.h | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -350,11 +350,6 @@ static inline pmd_t pmd_mkwrite(pmd_t pm
return pmd_set_flags(pmd, _PAGE_RW);
}
-static inline pmd_t pmd_mknotpresent(pmd_t pmd)
-{
- return pmd_clear_flags(pmd, _PAGE_PRESENT | _PAGE_PROTNONE);
-}
-
#ifdef CONFIG_HAVE_ARCH_SOFT_DIRTY
static inline int pte_soft_dirty(pte_t pte)
{
@@ -418,6 +413,12 @@ static inline pmd_t pfn_pmd(unsigned lon
return __pmd(pfn | massage_pgprot(pgprot));
}
+static inline pmd_t pmd_mknotpresent(pmd_t pmd)
+{
+ return pfn_pmd(pmd_pfn(pmd),
+ __pgprot(pmd_flags(pmd) & ~(_PAGE_PRESENT|_PAGE_PROTNONE)));
+}
+
static inline u64 flip_protnone_guard(u64 oldval, u64 val, u64 mask);
static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 103/107] x86/mm/pat: Make set_memory_np() L1TF safe
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 102/107] x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 104/107] x86/mm/kmmio: Make the tracer robust against L1TF Greg Kroah-Hartman
` (9 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit 958f79b9ee55dfaf00c8106ed1c22a2919e0028b upstream
set_memory_np() is used to mark kernel mappings not present, but it has
it's own open coded mechanism which does not have the L1TF protection of
inverting the address bits.
Replace the open coded PTE manipulation with the L1TF protecting low level
PTE routines.
Passes the CPA self test.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[ dwmw2: Pull in pud_mkhuge() from commit a00cc7d9dd, and pfn_pud() ]
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable.h | 27 +++++++++++++++++++++++++++
arch/x86/mm/pageattr.c | 8 ++++----
2 files changed, 31 insertions(+), 4 deletions(-)
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -413,12 +413,39 @@ static inline pmd_t pfn_pmd(unsigned lon
return __pmd(pfn | massage_pgprot(pgprot));
}
+static inline pud_t pfn_pud(unsigned long page_nr, pgprot_t pgprot)
+{
+ phys_addr_t pfn = page_nr << PAGE_SHIFT;
+ pfn ^= protnone_mask(pgprot_val(pgprot));
+ pfn &= PHYSICAL_PUD_PAGE_MASK;
+ return __pud(pfn | massage_pgprot(pgprot));
+}
+
static inline pmd_t pmd_mknotpresent(pmd_t pmd)
{
return pfn_pmd(pmd_pfn(pmd),
__pgprot(pmd_flags(pmd) & ~(_PAGE_PRESENT|_PAGE_PROTNONE)));
}
+static inline pud_t pud_set_flags(pud_t pud, pudval_t set)
+{
+ pudval_t v = native_pud_val(pud);
+
+ return __pud(v | set);
+}
+
+static inline pud_t pud_clear_flags(pud_t pud, pudval_t clear)
+{
+ pudval_t v = native_pud_val(pud);
+
+ return __pud(v & ~clear);
+}
+
+static inline pud_t pud_mkhuge(pud_t pud)
+{
+ return pud_set_flags(pud, _PAGE_PSE);
+}
+
static inline u64 flip_protnone_guard(u64 oldval, u64 val, u64 mask);
static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -1001,8 +1001,8 @@ static long populate_pmd(struct cpa_data
pmd = pmd_offset(pud, start);
- set_pmd(pmd, __pmd(cpa->pfn << PAGE_SHIFT | _PAGE_PSE |
- massage_pgprot(pmd_pgprot)));
+ set_pmd(pmd, pmd_mkhuge(pfn_pmd(cpa->pfn,
+ canon_pgprot(pmd_pgprot))));
start += PMD_SIZE;
cpa->pfn += PMD_SIZE >> PAGE_SHIFT;
@@ -1074,8 +1074,8 @@ static long populate_pud(struct cpa_data
* Map everything starting from the Gb boundary, possibly with 1G pages
*/
while (boot_cpu_has(X86_FEATURE_GBPAGES) && end - start >= PUD_SIZE) {
- set_pud(pud, __pud(cpa->pfn << PAGE_SHIFT | _PAGE_PSE |
- massage_pgprot(pud_pgprot)));
+ set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn,
+ canon_pgprot(pud_pgprot))));
start += PUD_SIZE;
cpa->pfn += PUD_SIZE >> PAGE_SHIFT;
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 104/107] x86/mm/kmmio: Make the tracer robust against L1TF
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 103/107] x86/mm/pat: Make set_memory_np() L1TF safe Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 105/107] tools headers: Synchronise x86 cpufeatures.h for L1TF additions Greg Kroah-Hartman
` (8 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andi Kleen, Thomas Gleixner, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <ak@linux.intel.com>
commit 1063711b57393c1999248cccb57bebfaf16739e7 upstream
The mmio tracer sets io mapping PTEs and PMDs to non present when enabled
without inverting the address bits, which makes the PTE entry vulnerable
for L1TF.
Make it use the right low level macros to actually invert the address bits
to protect against L1TF.
In principle this could be avoided because MMIO tracing is not likely to be
enabled on production machines, but the fix is straigt forward and for
consistency sake it's better to get rid of the open coded PTE manipulation.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/kmmio.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -125,24 +125,29 @@ static struct kmmio_fault_page *get_kmmi
static void clear_pmd_presence(pmd_t *pmd, bool clear, pmdval_t *old)
{
+ pmd_t new_pmd;
pmdval_t v = pmd_val(*pmd);
if (clear) {
- *old = v & _PAGE_PRESENT;
- v &= ~_PAGE_PRESENT;
- } else /* presume this has been called with clear==true previously */
- v |= *old;
- set_pmd(pmd, __pmd(v));
+ *old = v;
+ new_pmd = pmd_mknotpresent(*pmd);
+ } else {
+ /* Presume this has been called with clear==true previously */
+ new_pmd = __pmd(*old);
+ }
+ set_pmd(pmd, new_pmd);
}
static void clear_pte_presence(pte_t *pte, bool clear, pteval_t *old)
{
pteval_t v = pte_val(*pte);
if (clear) {
- *old = v & _PAGE_PRESENT;
- v &= ~_PAGE_PRESENT;
- } else /* presume this has been called with clear==true previously */
- v |= *old;
- set_pte_atomic(pte, __pte(v));
+ *old = v;
+ /* Nothing should care about address */
+ pte_clear(&init_mm, 0, pte);
+ } else {
+ /* Presume this has been called with clear==true previously */
+ set_pte_atomic(pte, __pte(*old));
+ }
}
static int clear_page_presence(struct kmmio_fault_page *f, bool clear)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 105/107] tools headers: Synchronise x86 cpufeatures.h for L1TF additions
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 104/107] x86/mm/kmmio: Make the tracer robust against L1TF Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 106/107] x86/microcode: Do not upload microcode if CPUs are offline Greg Kroah-Hartman
` (7 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
commit e24f14b0ff985f3e09e573ba1134bfdf42987e05 upstream
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/arch/x86/include/asm/cpufeatures.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -213,7 +213,7 @@
#define X86_FEATURE_IBPB ( 7*32+26) /* Indirect Branch Prediction Barrier */
#define X86_FEATURE_STIBP ( 7*32+27) /* Single Thread Indirect Branch Predictors */
#define X86_FEATURE_ZEN ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */
-
+#define X86_FEATURE_L1TF_PTEINV ( 7*32+29) /* "" L1TF workaround PTE inversion */
/* Virtualization flags: Linux defined, word 8 */
#define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */
@@ -317,6 +317,7 @@
#define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */
#define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */
#define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */
+#define X86_FEATURE_FLUSH_L1D (18*32+28) /* Flush L1D cache */
#define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
#define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */
@@ -349,5 +350,6 @@
#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */
#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */
#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */
+#define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
#endif /* _ASM_X86_CPUFEATURES_H */
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 106/107] x86/microcode: Do not upload microcode if CPUs are offline
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 105/107] tools headers: Synchronise x86 cpufeatures.h for L1TF additions Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 17:18 ` [PATCH 4.9 107/107] x86/microcode: Allow late microcode loading with SMT disabled Greg Kroah-Hartman
` (6 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ashok Raj, Borislav Petkov,
Thomas Gleixner, Tom Lendacky, Arjan Van De Ven, David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashok Raj <ashok.raj@intel.com>
commit 30ec26da9967d0d785abc24073129a34c3211777 upstream.
Avoid loading microcode if any of the CPUs are offline, and issue a
warning. Having different microcode revisions on the system at any time
is outright dangerous.
[ Borislav: Massage changelog. ]
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
Tested-by: Ashok Raj <ashok.raj@intel.com>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Arjan Van De Ven <arjan.van.de.ven@intel.com>
Link: http://lkml.kernel.org/r/1519352533-15992-4-git-send-email-ashok.raj@intel.com
Link: https://lkml.kernel.org/r/20180228102846.13447-5-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/microcode/core.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -384,6 +384,16 @@ static void __exit microcode_dev_exit(vo
/* fake device for request_firmware */
static struct platform_device *microcode_pdev;
+static int check_online_cpus(void)
+{
+ if (num_online_cpus() == num_present_cpus())
+ return 0;
+
+ pr_err("Not all CPUs online, aborting microcode update.\n");
+
+ return -EINVAL;
+}
+
static int reload_for_cpu(int cpu)
{
struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
@@ -418,7 +428,13 @@ static ssize_t reload_store(struct devic
return size;
get_online_cpus();
+
+ ret = check_online_cpus();
+ if (ret)
+ goto put;
+
mutex_lock(µcode_mutex);
+
for_each_online_cpu(cpu) {
tmp_ret = reload_for_cpu(cpu);
if (tmp_ret != 0)
@@ -431,6 +447,8 @@ static ssize_t reload_store(struct devic
if (!ret)
perf_check_microcode();
mutex_unlock(µcode_mutex);
+
+put:
put_online_cpus();
if (!ret)
^ permalink raw reply [flat|nested] 129+ messages in thread* [PATCH 4.9 107/107] x86/microcode: Allow late microcode loading with SMT disabled
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 106/107] x86/microcode: Do not upload microcode if CPUs are offline Greg Kroah-Hartman
@ 2018-08-14 17:18 ` Greg Kroah-Hartman
2018-08-14 18:58 ` [PATCH 4.9 000/107] 4.9.120-stable review Nathan Chancellor
` (5 subsequent siblings)
105 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-14 17:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josh Poimboeuf, Borislav Petkov,
David Woodhouse
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@redhat.com>
commit 07d981ad4cf1e78361c6db1c28ee5ba105f96cc1 upstream
The kernel unnecessarily prevents late microcode loading when SMT is
disabled. It should be safe to allow it if all the primary threads are
online.
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Borislav Petkov <bp@suse.de>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/microcode/core.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -386,12 +386,20 @@ static struct platform_device *microcode
static int check_online_cpus(void)
{
- if (num_online_cpus() == num_present_cpus())
- return 0;
+ unsigned int cpu;
- pr_err("Not all CPUs online, aborting microcode update.\n");
+ /*
+ * Make sure all CPUs are online. It's fine for SMT to be disabled if
+ * all the primary threads are still online.
+ */
+ for_each_present_cpu(cpu) {
+ if (topology_is_primary_thread(cpu) && !cpu_online(cpu)) {
+ pr_err("Not all CPUs online, aborting microcode update.\n");
+ return -EINVAL;
+ }
+ }
- return -EINVAL;
+ return 0;
}
static int reload_for_cpu(int cpu)
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2018-08-14 17:18 ` [PATCH 4.9 107/107] x86/microcode: Allow late microcode loading with SMT disabled Greg Kroah-Hartman
@ 2018-08-14 18:58 ` Nathan Chancellor
2018-08-15 5:51 ` Greg Kroah-Hartman
2018-08-15 0:36 ` Sebastian Gottschall
` (4 subsequent siblings)
105 siblings, 1 reply; 129+ messages in thread
From: Nathan Chancellor @ 2018-08-14 18:58 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Tue, Aug 14, 2018 at 07:16:23PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.120 release.
> There are 107 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Merged, compiled with -Werror, and installed onto my OnePlus 6, which is
my daily driver while my Pixel 2 XL is in for another screen RMA...
No initial issues noticed in dmesg or general usage.
Thanks!
Nathan
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-14 18:58 ` [PATCH 4.9 000/107] 4.9.120-stable review Nathan Chancellor
@ 2018-08-15 5:51 ` Greg Kroah-Hartman
0 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-15 5:51 UTC (permalink / raw)
To: Nathan Chancellor
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Tue, Aug 14, 2018 at 11:58:18AM -0700, Nathan Chancellor wrote:
> On Tue, Aug 14, 2018 at 07:16:23PM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.9.120 release.
> > There are 107 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
>
> Merged, compiled with -Werror, and installed onto my OnePlus 6, which is
> my daily driver while my Pixel 2 XL is in for another screen RMA...
>
> No initial issues noticed in dmesg or general usage.
Thanks for the testing and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2018-08-14 18:58 ` [PATCH 4.9 000/107] 4.9.120-stable review Nathan Chancellor
@ 2018-08-15 0:36 ` Sebastian Gottschall
2018-08-15 1:00 ` Nathan Chancellor
` (2 more replies)
2018-08-15 6:14 ` Greg Kroah-Hartman
` (3 subsequent siblings)
105 siblings, 3 replies; 129+ messages in thread
From: Sebastian Gottschall @ 2018-08-15 0:36 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, shuah, patches, ben.hutchings,
lkft-triage, stable
if SWAP is disabled in kernel config, the following compile error will
raise up with this release
arch/x86/built-in.o: in function `max_swapfile_size': (.text+0x3bba1):
undefined reference to `generic_max_swapfile_size'
of course this is simple to fix. the function max_swapfile_size must be
excluded if CONFIG_SWAP is disabled
Sebastian
Am 14.08.2018 um 19:16 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 4.9.120 release.
> There are 107 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 4.9.120-rc1
>
> Josh Poimboeuf <jpoimboe@redhat.com>
> x86/microcode: Allow late microcode loading with SMT disabled
>
> Ashok Raj <ashok.raj@intel.com>
> x86/microcode: Do not upload microcode if CPUs are offline
>
> David Woodhouse <dwmw@amazon.co.uk>
> tools headers: Synchronise x86 cpufeatures.h for L1TF additions
>
> Andi Kleen <ak@linux.intel.com>
> x86/mm/kmmio: Make the tracer robust against L1TF
>
> Andi Kleen <ak@linux.intel.com>
> x86/mm/pat: Make set_memory_np() L1TF safe
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Invert all not present mappings
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Fix SMT supported evaluation
>
> Paolo Bonzini <pbonzini@redhat.com>
> KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/speculation: Simplify sysfs report of VMX L1TF vulnerability
>
> Paolo Bonzini <pbonzini@redhat.com>
> KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR
>
> Wanpeng Li <wanpengli@tencent.com>
> KVM: X86: Allow userspace to define the microcode version
>
> Wanpeng Li <wanpengli@tencent.com>
> KVM: X86: Introduce kvm_get_msr_feature()
>
> Tom Lendacky <thomas.lendacky@amd.com>
> KVM: SVM: Add MSR-based feature support for serializing LFENCE
>
> Tom Lendacky <thomas.lendacky@amd.com>
> KVM: x86: Add a framework for supporting MSR-based features
>
> Thomas Gleixner <tglx@linutronix.de>
> Documentation/l1tf: Remove Yonah processors from not vulnerable list
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr()
>
> Nicolai Stange <nstange@suse.de>
> x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d
>
> Nicolai Stange <nstange@suse.de>
> x86: Don't include linux/irq.h from asm/hardirq.h
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d
>
> Nicolai Stange <nstange@suse.de>
> x86/irq: Demote irq_cpustat_t::__softirq_pending to u16
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond'
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush()
>
> Josh Poimboeuf <jpoimboe@redhat.com>
> cpu/hotplug: detect SMT disabled by BIOS
>
> Tony Luck <tony.luck@intel.com>
> Documentation/l1tf: Fix typos
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Initialize the vmx_l1d_flush_pages' content
>
> Thomas Gleixner <tglx@linutronix.de>
> Documentation: Add section about CPU vulnerabilities
>
> Jiri Kosina <jkosina@suse.cz>
> x86/bugs, kvm: Introduce boot-time control of L1TF mitigations
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early
>
> Jiri Kosina <jkosina@suse.cz>
> cpu/hotplug: Expose SMT control init function
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Allow runtime control of L1D flush
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Serialize L1D flush parameter setter
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Add static key for flush always
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Move l1tf setup function
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/l1tf: Handle EPT disabled state proper
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Drop L1TF MSR list approach
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/litf: Introduce vmx status variable
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Online siblings when SMT control is turned on
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Add find_msr() helper function
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers
>
> Jim Mattson <jmattson@google.com>
> kvm: nVMX: Update MSR load counts on a VMCS switch
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/KVM/VMX: Add L1D flush logic
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/KVM/VMX: Add L1D MSR based flush
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/KVM/VMX: Add L1D flush algorithm
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Add module argument for L1TF mitigation
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Boot HT siblings at least once
>
> Thomas Gleixner <tglx@linutronix.de>
> Revert "x86/apic: Ignore secondary threads if nosmt=force"
>
> Michal Hocko <mhocko@suse.cz>
> x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
>
> Vlastimil Babka <vbabka@suse.cz>
> x86/speculation/l1tf: Protect PAE swap entries against L1TF
>
> Borislav Petkov <bp@suse.de>
> x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/cpufeatures: Add detection of L1D cache flush support.
>
> Vlastimil Babka <vbabka@suse.cz>
> x86/speculation/l1tf: Extend 64bit swap file size limit
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/apic: Ignore secondary threads if nosmt=force
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/AMD: Evaluate smp_num_siblings early
>
> Borislav Petkov <bp@suse.de>
> x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/intel: Evaluate smp_num_siblings early
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/topology: Provide detect_extended_topology_early()
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/common: Provide detect_ht_early()
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/AMD: Remove the pointless detect_ht() call
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu: Remove the pointless CPU printout
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Provide knobs to control SMT
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Split do_cpu_down()
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Make bringup/teardown of smp threads symmetric
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/topology: Provide topology_smt_supported()
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/smp: Provide topology_is_primary_thread()
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/bugs: Move the l1tf function and define pr_fmt properly
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Limit swap file size to MAX_PA/2
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Add sysfs reporting for l1tf
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Make sure the first page is always reserved
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
>
> Linus Torvalds <torvalds@linux-foundation.org>
> x86/speculation/l1tf: Protect swap entries against L1TF
>
> Linus Torvalds <torvalds@linux-foundation.org>
> x86/speculation/l1tf: Change order of offset/type in swap entry
>
> Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> mm: x86: move _PAGE_SWP_SOFT_DIRTY from bit 7 to bit 1
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
>
> Nick Desaulniers <ndesaulniers@google.com>
> x86/irqflags: Provide a declaration for native_save_fl
>
> Masami Hiramatsu <mhiramat@kernel.org>
> kprobes/x86: Fix %p uses in error messages
>
> Jiri Kosina <jkosina@suse.cz>
> x86/speculation: Protect against userspace-userspace spectreRSB
>
> Peter Zijlstra <peterz@infradead.org>
> x86/paravirt: Fix spectre-v2 mitigations for paravirt guests
>
> Oleksij Rempel <o.rempel@pengutronix.de>
> ARM: dts: imx6sx: fix irq for pcie bridge
>
> Michael Mera <dev@michaelmera.com>
> IB/ocrdma: fix out of bounds access to local buffer
>
> Fabio Estevam <fabio.estevam@nxp.com>
> mtd: nand: qcom: Add a NULL check for devm_kasprintf()
>
> Jack Morgenstein <jackm@dev.mellanox.co.il>
> IB/mlx4: Mark user MR as writable if actual virtual memory is writable
>
> Jack Morgenstein <jackm@dev.mellanox.co.il>
> IB/core: Make testing MR flags for writability a static inline function
>
> Eric W. Biederman <ebiederm@xmission.com>
> proc: Fix proc_sys_prune_dcache to hold a sb reference
>
> Eric W. Biederman <ebiederm@xmission.com>
> proc/sysctl: Don't grab i_lock under sysctl_lock.
>
> Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
> proc/sysctl: prune stale dentries during unregistering
>
> Al Viro <viro@zeniv.linux.org.uk>
> fix __legitimize_mnt()/mntput() race
>
> Al Viro <viro@zeniv.linux.org.uk>
> fix mntput/mntput race
>
> Al Viro <viro@zeniv.linux.org.uk>
> make sure that __dentry_kill() always invalidates d_seq, unhashed or not
>
> Al Viro <viro@zeniv.linux.org.uk>
> root dentries need RCU-delayed freeing
>
> Linus Torvalds <torvalds@linux-foundation.org>
> init: rename and re-order boot_cpu_state_init()
>
> Bart Van Assche <bart.vanassche@wdc.com>
> scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices
>
> Juergen Gross <jgross@suse.com>
> xen/netfront: don't cache skb_shinfo()
>
> Linus Torvalds <torvalds@linux-foundation.org>
> Mark HI and TASKLET softirq synchronous
>
> Andrey Konovalov <andreyknvl@google.com>
> kasan: add no_sanitize attribute for clang builds
>
> John David Anglin <dave.anglin@bell.net>
> parisc: Define mb() and add memory barriers to assembler unlock sequences
>
> Helge Deller <deller@gmx.de>
> parisc: Enable CONFIG_MLONGCALLS by default
>
> Tadeusz Struk <tadeusz.struk@intel.com>
> tpm: fix race condition in tpm_common_write()
>
> Theodore Ts'o <tytso@mit.edu>
> ext4: fix check to prevent initializing reserved inodes
>
>
> -------------
>
> Diffstat:
>
> Documentation/ABI/testing/sysfs-devices-system-cpu | 24 +
> Documentation/index.rst | 1 +
> Documentation/kernel-parameters.txt | 78 +++
> Documentation/l1tf.rst | 610 +++++++++++++++++++++
> Documentation/virtual/kvm/api.txt | 40 +-
> Makefile | 4 +-
> arch/Kconfig | 3 +
> arch/arm/boot/dts/imx6sx.dtsi | 2 +-
> arch/parisc/Kconfig | 2 +-
> arch/parisc/include/asm/barrier.h | 32 ++
> arch/parisc/kernel/entry.S | 2 +
> arch/parisc/kernel/pacache.S | 1 +
> arch/parisc/kernel/syscall.S | 4 +
> arch/x86/Kconfig | 1 +
> arch/x86/include/asm/apic.h | 10 +
> arch/x86/include/asm/cpufeatures.h | 4 +-
> arch/x86/include/asm/dmi.h | 2 +-
> arch/x86/include/asm/hardirq.h | 26 +-
> arch/x86/include/asm/irqflags.h | 2 +
> arch/x86/include/asm/kvm_host.h | 9 +
> arch/x86/include/asm/msr-index.h | 7 +
> arch/x86/include/asm/page_32_types.h | 9 +-
> arch/x86/include/asm/pgtable-2level.h | 17 +
> arch/x86/include/asm/pgtable-3level.h | 37 +-
> arch/x86/include/asm/pgtable-invert.h | 32 ++
> arch/x86/include/asm/pgtable.h | 85 ++-
> arch/x86/include/asm/pgtable_64.h | 48 +-
> arch/x86/include/asm/pgtable_types.h | 10 +-
> arch/x86/include/asm/processor.h | 17 +
> arch/x86/include/asm/topology.h | 6 +-
> arch/x86/include/asm/vmx.h | 11 +
> arch/x86/kernel/apic/apic.c | 17 +
> arch/x86/kernel/apic/htirq.c | 2 +
> arch/x86/kernel/apic/io_apic.c | 1 +
> arch/x86/kernel/apic/msi.c | 1 +
> arch/x86/kernel/apic/vector.c | 1 +
> arch/x86/kernel/cpu/amd.c | 53 +-
> arch/x86/kernel/cpu/bugs.c | 171 ++++--
> arch/x86/kernel/cpu/common.c | 56 +-
> arch/x86/kernel/cpu/cpu.h | 2 +
> arch/x86/kernel/cpu/intel.c | 7 +
> arch/x86/kernel/cpu/microcode/core.c | 26 +
> arch/x86/kernel/cpu/topology.c | 41 +-
> arch/x86/kernel/fpu/core.c | 1 +
> arch/x86/kernel/ftrace.c | 1 +
> arch/x86/kernel/hpet.c | 1 +
> arch/x86/kernel/i8259.c | 1 +
> arch/x86/kernel/irq.c | 1 +
> arch/x86/kernel/irq_32.c | 1 +
> arch/x86/kernel/irq_64.c | 1 +
> arch/x86/kernel/irqinit.c | 1 +
> arch/x86/kernel/kprobes/core.c | 5 +-
> arch/x86/kernel/kprobes/opt.c | 1 +
> arch/x86/kernel/paravirt.c | 14 +-
> arch/x86/kernel/setup.c | 6 +
> arch/x86/kernel/smp.c | 1 +
> arch/x86/kernel/smpboot.c | 18 +
> arch/x86/kernel/time.c | 1 +
> arch/x86/kvm/svm.c | 46 +-
> arch/x86/kvm/vmx.c | 426 ++++++++++++--
> arch/x86/kvm/x86.c | 133 ++++-
> arch/x86/mm/fault.c | 1 +
> arch/x86/mm/init.c | 23 +
> arch/x86/mm/kaiser.c | 1 +
> arch/x86/mm/kmmio.c | 25 +-
> arch/x86/mm/mmap.c | 21 +
> arch/x86/mm/pageattr.c | 8 +-
> arch/x86/platform/efi/efi_64.c | 1 +
> arch/x86/platform/efi/quirks.c | 1 +
> .../intel-mid/device_libs/platform_mrfld_wdt.c | 1 +
> arch/x86/platform/uv/tlb_uv.c | 1 +
> arch/x86/xen/enlighten.c | 1 +
> arch/x86/xen/setup.c | 1 +
> drivers/acpi/acpi_lpss.c | 2 +
> drivers/base/cpu.c | 8 +
> drivers/char/tpm/tpm-dev.c | 43 +-
> drivers/infiniband/core/umem.c | 11 +-
> drivers/infiniband/hw/mlx4/mr.c | 50 +-
> drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +-
> drivers/mtd/nand/qcom_nandc.c | 3 +
> drivers/net/xen-netfront.c | 8 +-
> drivers/pci/host/pci-hyperv.c | 2 +
> drivers/scsi/sr.c | 29 +-
> fs/dcache.c | 13 +-
> fs/ext4/ialloc.c | 5 +-
> fs/ext4/super.c | 8 +-
> fs/namespace.c | 28 +-
> fs/proc/inode.c | 3 +-
> fs/proc/internal.h | 7 +-
> fs/proc/proc_sysctl.c | 83 ++-
> include/asm-generic/pgtable.h | 12 +
> include/linux/compiler-clang.h | 3 +
> include/linux/cpu.h | 23 +-
> include/linux/swapfile.h | 2 +
> include/linux/sysctl.h | 1 +
> include/rdma/ib_verbs.h | 14 +
> include/uapi/linux/kvm.h | 2 +
> init/main.c | 2 +-
> kernel/cpu.c | 282 +++++++++-
> kernel/smp.c | 2 +
> kernel/softirq.c | 12 +-
> mm/memory.c | 29 +-
> mm/mprotect.c | 49 ++
> mm/swapfile.c | 46 +-
> tools/arch/x86/include/asm/cpufeatures.h | 4 +-
> 105 files changed, 2680 insertions(+), 366 deletions(-)
>
>
>
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 0:36 ` Sebastian Gottschall
@ 2018-08-15 1:00 ` Nathan Chancellor
2018-08-15 1:01 ` Guenter Roeck
2018-08-15 5:55 ` Greg Kroah-Hartman
2 siblings, 0 replies; 129+ messages in thread
From: Nathan Chancellor @ 2018-08-15 1:00 UTC (permalink / raw)
To: Sebastian Gottschall
Cc: Greg Kroah-Hartman, linux-kernel, torvalds, akpm, linux, shuah,
patches, ben.hutchings, lkft-triage, stable
On Wed, Aug 15, 2018 at 02:36:00AM +0200, Sebastian Gottschall wrote:
> if SWAP is disabled in kernel config, the following compile error will raise
> up with this release
>
> arch/x86/built-in.o: in function `max_swapfile_size': (.text+0x3bba1):
> undefined reference to `generic_max_swapfile_size'
>
> of course this is simple to fix. the function max_swapfile_size must be
> excluded if CONFIG_SWAP is disabled
>
> Sebastian
>
This is fixed upstream as commmit 792adb90fa72 ("x86/init: fix build
with CONFIG_SWAP=n").
Cheers,
Nathan
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 0:36 ` Sebastian Gottschall
2018-08-15 1:00 ` Nathan Chancellor
@ 2018-08-15 1:01 ` Guenter Roeck
2018-08-15 5:55 ` Greg Kroah-Hartman
2 siblings, 0 replies; 129+ messages in thread
From: Guenter Roeck @ 2018-08-15 1:01 UTC (permalink / raw)
To: Sebastian Gottschall, Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah, patches, ben.hutchings, lkft-triage, stable
On 08/14/2018 05:36 PM, Sebastian Gottschall wrote:
> if SWAP is disabled in kernel config, the following compile error will raise up with this release
>
> arch/x86/built-in.o: in function `max_swapfile_size': (.text+0x3bba1): undefined reference to `generic_max_swapfile_size'
>
> of course this is simple to fix. the function max_swapfile_size must be excluded if CONFIG_SWAP is disabled
>
Fixed with upstream commit 792adb90fa72 ("x86/init: fix build with CONFIG_SWAP=n").
Also needed in other stable branches (at least in 4.4).
Guenter
> Sebastian
>
> Am 14.08.2018 um 19:16 schrieb Greg Kroah-Hartman:
>> This is the start of the stable review cycle for the 4.9.120 release.
>> There are 107 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
>> Anything received after that time might be too late.
>>
>> The whole patch series can be found in one patch at:
>> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc1.gz
>> or in the git tree and branch at:
>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
>> and the diffstat can be found below.
>>
>> thanks,
>>
>> greg k-h
>>
>> -------------
>> Pseudo-Shortlog of commits:
>>
>> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Linux 4.9.120-rc1
>>
>> Josh Poimboeuf <jpoimboe@redhat.com>
>> x86/microcode: Allow late microcode loading with SMT disabled
>>
>> Ashok Raj <ashok.raj@intel.com>
>> x86/microcode: Do not upload microcode if CPUs are offline
>>
>> David Woodhouse <dwmw@amazon.co.uk>
>> tools headers: Synchronise x86 cpufeatures.h for L1TF additions
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/mm/kmmio: Make the tracer robust against L1TF
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/mm/pat: Make set_memory_np() L1TF safe
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/speculation/l1tf: Invert all not present mappings
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> cpu/hotplug: Fix SMT supported evaluation
>>
>> Paolo Bonzini <pbonzini@redhat.com>
>> KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry
>>
>> Paolo Bonzini <pbonzini@redhat.com>
>> x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry
>>
>> Paolo Bonzini <pbonzini@redhat.com>
>> x86/speculation: Simplify sysfs report of VMX L1TF vulnerability
>>
>> Paolo Bonzini <pbonzini@redhat.com>
>> KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR
>>
>> Wanpeng Li <wanpengli@tencent.com>
>> KVM: X86: Allow userspace to define the microcode version
>>
>> Wanpeng Li <wanpengli@tencent.com>
>> KVM: X86: Introduce kvm_get_msr_feature()
>>
>> Tom Lendacky <thomas.lendacky@amd.com>
>> KVM: SVM: Add MSR-based feature support for serializing LFENCE
>>
>> Tom Lendacky <thomas.lendacky@amd.com>
>> KVM: x86: Add a framework for supporting MSR-based features
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> Documentation/l1tf: Remove Yonah processors from not vulnerable list
>>
>> Nicolai Stange <nstange@suse.de>
>> x86/KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr()
>>
>> Nicolai Stange <nstange@suse.de>
>> x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d
>>
>> Nicolai Stange <nstange@suse.de>
>> x86: Don't include linux/irq.h from asm/hardirq.h
>>
>> Nicolai Stange <nstange@suse.de>
>> x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d
>>
>> Nicolai Stange <nstange@suse.de>
>> x86/irq: Demote irq_cpustat_t::__softirq_pending to u16
>>
>> Nicolai Stange <nstange@suse.de>
>> x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()
>>
>> Nicolai Stange <nstange@suse.de>
>> x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond'
>>
>> Nicolai Stange <nstange@suse.de>
>> x86/KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush()
>>
>> Josh Poimboeuf <jpoimboe@redhat.com>
>> cpu/hotplug: detect SMT disabled by BIOS
>>
>> Tony Luck <tony.luck@intel.com>
>> Documentation/l1tf: Fix typos
>>
>> Nicolai Stange <nstange@suse.de>
>> x86/KVM/VMX: Initialize the vmx_l1d_flush_pages' content
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> Documentation: Add section about CPU vulnerabilities
>>
>> Jiri Kosina <jkosina@suse.cz>
>> x86/bugs, kvm: Introduce boot-time control of L1TF mitigations
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early
>>
>> Jiri Kosina <jkosina@suse.cz>
>> cpu/hotplug: Expose SMT control init function
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/kvm: Allow runtime control of L1D flush
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/kvm: Serialize L1D flush parameter setter
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/kvm: Add static key for flush always
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/kvm: Move l1tf setup function
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/l1tf: Handle EPT disabled state proper
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/kvm: Drop L1TF MSR list approach
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/litf: Introduce vmx status variable
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> cpu/hotplug: Online siblings when SMT control is turned on
>>
>> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>> x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
>>
>> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>> x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
>>
>> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>> x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting
>>
>> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>> x86/KVM/VMX: Add find_msr() helper function
>>
>> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>> x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers
>>
>> Jim Mattson <jmattson@google.com>
>> kvm: nVMX: Update MSR load counts on a VMCS switch
>>
>> Paolo Bonzini <pbonzini@redhat.com>
>> x86/KVM/VMX: Add L1D flush logic
>>
>> Paolo Bonzini <pbonzini@redhat.com>
>> x86/KVM/VMX: Add L1D MSR based flush
>>
>> Paolo Bonzini <pbonzini@redhat.com>
>> x86/KVM/VMX: Add L1D flush algorithm
>>
>> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>> x86/KVM/VMX: Add module argument for L1TF mitigation
>>
>> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>> x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> cpu/hotplug: Boot HT siblings at least once
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> Revert "x86/apic: Ignore secondary threads if nosmt=force"
>>
>> Michal Hocko <mhocko@suse.cz>
>> x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
>>
>> Vlastimil Babka <vbabka@suse.cz>
>> x86/speculation/l1tf: Protect PAE swap entries against L1TF
>>
>> Borislav Petkov <bp@suse.de>
>> x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings
>>
>> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>> x86/cpufeatures: Add detection of L1D cache flush support.
>>
>> Vlastimil Babka <vbabka@suse.cz>
>> x86/speculation/l1tf: Extend 64bit swap file size limit
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/apic: Ignore secondary threads if nosmt=force
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/cpu/AMD: Evaluate smp_num_siblings early
>>
>> Borislav Petkov <bp@suse.de>
>> x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/cpu/intel: Evaluate smp_num_siblings early
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/cpu/topology: Provide detect_extended_topology_early()
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/cpu/common: Provide detect_ht_early()
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/cpu/AMD: Remove the pointless detect_ht() call
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/cpu: Remove the pointless CPU printout
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> cpu/hotplug: Provide knobs to control SMT
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> cpu/hotplug: Split do_cpu_down()
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> cpu/hotplug: Make bringup/teardown of smp threads symmetric
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/topology: Provide topology_smt_supported()
>>
>> Thomas Gleixner <tglx@linutronix.de>
>> x86/smp: Provide topology_is_primary_thread()
>>
>> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>> x86/bugs: Move the l1tf function and define pr_fmt properly
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/speculation/l1tf: Limit swap file size to MAX_PA/2
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/speculation/l1tf: Add sysfs reporting for l1tf
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/speculation/l1tf: Make sure the first page is always reserved
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
>>
>> Linus Torvalds <torvalds@linux-foundation.org>
>> x86/speculation/l1tf: Protect swap entries against L1TF
>>
>> Linus Torvalds <torvalds@linux-foundation.org>
>> x86/speculation/l1tf: Change order of offset/type in swap entry
>>
>> Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
>> mm: x86: move _PAGE_SWP_SOFT_DIRTY from bit 7 to bit 1
>>
>> Andi Kleen <ak@linux.intel.com>
>> x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
>>
>> Nick Desaulniers <ndesaulniers@google.com>
>> x86/irqflags: Provide a declaration for native_save_fl
>>
>> Masami Hiramatsu <mhiramat@kernel.org>
>> kprobes/x86: Fix %p uses in error messages
>>
>> Jiri Kosina <jkosina@suse.cz>
>> x86/speculation: Protect against userspace-userspace spectreRSB
>>
>> Peter Zijlstra <peterz@infradead.org>
>> x86/paravirt: Fix spectre-v2 mitigations for paravirt guests
>>
>> Oleksij Rempel <o.rempel@pengutronix.de>
>> ARM: dts: imx6sx: fix irq for pcie bridge
>>
>> Michael Mera <dev@michaelmera.com>
>> IB/ocrdma: fix out of bounds access to local buffer
>>
>> Fabio Estevam <fabio.estevam@nxp.com>
>> mtd: nand: qcom: Add a NULL check for devm_kasprintf()
>>
>> Jack Morgenstein <jackm@dev.mellanox.co.il>
>> IB/mlx4: Mark user MR as writable if actual virtual memory is writable
>>
>> Jack Morgenstein <jackm@dev.mellanox.co.il>
>> IB/core: Make testing MR flags for writability a static inline function
>>
>> Eric W. Biederman <ebiederm@xmission.com>
>> proc: Fix proc_sys_prune_dcache to hold a sb reference
>>
>> Eric W. Biederman <ebiederm@xmission.com>
>> proc/sysctl: Don't grab i_lock under sysctl_lock.
>>
>> Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
>> proc/sysctl: prune stale dentries during unregistering
>>
>> Al Viro <viro@zeniv.linux.org.uk>
>> fix __legitimize_mnt()/mntput() race
>>
>> Al Viro <viro@zeniv.linux.org.uk>
>> fix mntput/mntput race
>>
>> Al Viro <viro@zeniv.linux.org.uk>
>> make sure that __dentry_kill() always invalidates d_seq, unhashed or not
>>
>> Al Viro <viro@zeniv.linux.org.uk>
>> root dentries need RCU-delayed freeing
>>
>> Linus Torvalds <torvalds@linux-foundation.org>
>> init: rename and re-order boot_cpu_state_init()
>>
>> Bart Van Assche <bart.vanassche@wdc.com>
>> scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled
>>
>> Hans de Goede <hdegoede@redhat.com>
>> ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices
>>
>> Juergen Gross <jgross@suse.com>
>> xen/netfront: don't cache skb_shinfo()
>>
>> Linus Torvalds <torvalds@linux-foundation.org>
>> Mark HI and TASKLET softirq synchronous
>>
>> Andrey Konovalov <andreyknvl@google.com>
>> kasan: add no_sanitize attribute for clang builds
>>
>> John David Anglin <dave.anglin@bell.net>
>> parisc: Define mb() and add memory barriers to assembler unlock sequences
>>
>> Helge Deller <deller@gmx.de>
>> parisc: Enable CONFIG_MLONGCALLS by default
>>
>> Tadeusz Struk <tadeusz.struk@intel.com>
>> tpm: fix race condition in tpm_common_write()
>>
>> Theodore Ts'o <tytso@mit.edu>
>> ext4: fix check to prevent initializing reserved inodes
>>
>>
>> -------------
>>
>> Diffstat:
>>
>> Documentation/ABI/testing/sysfs-devices-system-cpu | 24 +
>> Documentation/index.rst | 1 +
>> Documentation/kernel-parameters.txt | 78 +++
>> Documentation/l1tf.rst | 610 +++++++++++++++++++++
>> Documentation/virtual/kvm/api.txt | 40 +-
>> Makefile | 4 +-
>> arch/Kconfig | 3 +
>> arch/arm/boot/dts/imx6sx.dtsi | 2 +-
>> arch/parisc/Kconfig | 2 +-
>> arch/parisc/include/asm/barrier.h | 32 ++
>> arch/parisc/kernel/entry.S | 2 +
>> arch/parisc/kernel/pacache.S | 1 +
>> arch/parisc/kernel/syscall.S | 4 +
>> arch/x86/Kconfig | 1 +
>> arch/x86/include/asm/apic.h | 10 +
>> arch/x86/include/asm/cpufeatures.h | 4 +-
>> arch/x86/include/asm/dmi.h | 2 +-
>> arch/x86/include/asm/hardirq.h | 26 +-
>> arch/x86/include/asm/irqflags.h | 2 +
>> arch/x86/include/asm/kvm_host.h | 9 +
>> arch/x86/include/asm/msr-index.h | 7 +
>> arch/x86/include/asm/page_32_types.h | 9 +-
>> arch/x86/include/asm/pgtable-2level.h | 17 +
>> arch/x86/include/asm/pgtable-3level.h | 37 +-
>> arch/x86/include/asm/pgtable-invert.h | 32 ++
>> arch/x86/include/asm/pgtable.h | 85 ++-
>> arch/x86/include/asm/pgtable_64.h | 48 +-
>> arch/x86/include/asm/pgtable_types.h | 10 +-
>> arch/x86/include/asm/processor.h | 17 +
>> arch/x86/include/asm/topology.h | 6 +-
>> arch/x86/include/asm/vmx.h | 11 +
>> arch/x86/kernel/apic/apic.c | 17 +
>> arch/x86/kernel/apic/htirq.c | 2 +
>> arch/x86/kernel/apic/io_apic.c | 1 +
>> arch/x86/kernel/apic/msi.c | 1 +
>> arch/x86/kernel/apic/vector.c | 1 +
>> arch/x86/kernel/cpu/amd.c | 53 +-
>> arch/x86/kernel/cpu/bugs.c | 171 ++++--
>> arch/x86/kernel/cpu/common.c | 56 +-
>> arch/x86/kernel/cpu/cpu.h | 2 +
>> arch/x86/kernel/cpu/intel.c | 7 +
>> arch/x86/kernel/cpu/microcode/core.c | 26 +
>> arch/x86/kernel/cpu/topology.c | 41 +-
>> arch/x86/kernel/fpu/core.c | 1 +
>> arch/x86/kernel/ftrace.c | 1 +
>> arch/x86/kernel/hpet.c | 1 +
>> arch/x86/kernel/i8259.c | 1 +
>> arch/x86/kernel/irq.c | 1 +
>> arch/x86/kernel/irq_32.c | 1 +
>> arch/x86/kernel/irq_64.c | 1 +
>> arch/x86/kernel/irqinit.c | 1 +
>> arch/x86/kernel/kprobes/core.c | 5 +-
>> arch/x86/kernel/kprobes/opt.c | 1 +
>> arch/x86/kernel/paravirt.c | 14 +-
>> arch/x86/kernel/setup.c | 6 +
>> arch/x86/kernel/smp.c | 1 +
>> arch/x86/kernel/smpboot.c | 18 +
>> arch/x86/kernel/time.c | 1 +
>> arch/x86/kvm/svm.c | 46 +-
>> arch/x86/kvm/vmx.c | 426 ++++++++++++--
>> arch/x86/kvm/x86.c | 133 ++++-
>> arch/x86/mm/fault.c | 1 +
>> arch/x86/mm/init.c | 23 +
>> arch/x86/mm/kaiser.c | 1 +
>> arch/x86/mm/kmmio.c | 25 +-
>> arch/x86/mm/mmap.c | 21 +
>> arch/x86/mm/pageattr.c | 8 +-
>> arch/x86/platform/efi/efi_64.c | 1 +
>> arch/x86/platform/efi/quirks.c | 1 +
>> .../intel-mid/device_libs/platform_mrfld_wdt.c | 1 +
>> arch/x86/platform/uv/tlb_uv.c | 1 +
>> arch/x86/xen/enlighten.c | 1 +
>> arch/x86/xen/setup.c | 1 +
>> drivers/acpi/acpi_lpss.c | 2 +
>> drivers/base/cpu.c | 8 +
>> drivers/char/tpm/tpm-dev.c | 43 +-
>> drivers/infiniband/core/umem.c | 11 +-
>> drivers/infiniband/hw/mlx4/mr.c | 50 +-
>> drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +-
>> drivers/mtd/nand/qcom_nandc.c | 3 +
>> drivers/net/xen-netfront.c | 8 +-
>> drivers/pci/host/pci-hyperv.c | 2 +
>> drivers/scsi/sr.c | 29 +-
>> fs/dcache.c | 13 +-
>> fs/ext4/ialloc.c | 5 +-
>> fs/ext4/super.c | 8 +-
>> fs/namespace.c | 28 +-
>> fs/proc/inode.c | 3 +-
>> fs/proc/internal.h | 7 +-
>> fs/proc/proc_sysctl.c | 83 ++-
>> include/asm-generic/pgtable.h | 12 +
>> include/linux/compiler-clang.h | 3 +
>> include/linux/cpu.h | 23 +-
>> include/linux/swapfile.h | 2 +
>> include/linux/sysctl.h | 1 +
>> include/rdma/ib_verbs.h | 14 +
>> include/uapi/linux/kvm.h | 2 +
>> init/main.c | 2 +-
>> kernel/cpu.c | 282 +++++++++-
>> kernel/smp.c | 2 +
>> kernel/softirq.c | 12 +-
>> mm/memory.c | 29 +-
>> mm/mprotect.c | 49 ++
>> mm/swapfile.c | 46 +-
>> tools/arch/x86/include/asm/cpufeatures.h | 4 +-
>> 105 files changed, 2680 insertions(+), 366 deletions(-)
>>
>>
>>
>
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 0:36 ` Sebastian Gottschall
2018-08-15 1:00 ` Nathan Chancellor
2018-08-15 1:01 ` Guenter Roeck
@ 2018-08-15 5:55 ` Greg Kroah-Hartman
2 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-15 5:55 UTC (permalink / raw)
To: Sebastian Gottschall
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Wed, Aug 15, 2018 at 02:36:00AM +0200, Sebastian Gottschall wrote:
> if SWAP is disabled in kernel config, the following compile error will raise
> up with this release
>
> arch/x86/built-in.o: in function `max_swapfile_size': (.text+0x3bba1):
> undefined reference to `generic_max_swapfile_size'
>
> of course this is simple to fix. the function max_swapfile_size must be
> excluded if CONFIG_SWAP is disabled
Now fixed up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2018-08-15 0:36 ` Sebastian Gottschall
@ 2018-08-15 6:14 ` Greg Kroah-Hartman
2018-08-15 12:20 ` Guenter Roeck
2018-08-15 13:12 ` Guenter Roeck
` (2 subsequent siblings)
105 siblings, 1 reply; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-15 6:14 UTC (permalink / raw)
To: linux-kernel
Cc: torvalds, akpm, linux, shuah, patches, ben.hutchings,
lkft-triage, stable
On Tue, Aug 14, 2018 at 07:16:23PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.120 release.
> There are 107 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc1.gz
-rc2 is now out:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc2.gz
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 6:14 ` Greg Kroah-Hartman
@ 2018-08-15 12:20 ` Guenter Roeck
2018-08-15 13:14 ` Greg Kroah-Hartman
0 siblings, 1 reply; 129+ messages in thread
From: Guenter Roeck @ 2018-08-15 12:20 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah, patches, ben.hutchings, lkft-triage, stable
On 08/14/2018 11:14 PM, Greg Kroah-Hartman wrote:
> On Tue, Aug 14, 2018 at 07:16:23PM +0200, Greg Kroah-Hartman wrote:
>> This is the start of the stable review cycle for the 4.9.120 release.
>> There are 107 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
>> Anything received after that time might be too late.
>>
>> The whole patch series can be found in one patch at:
>> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc1.gz
>
> -rc2 is now out:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc2.gz
>
Heads up: We'll need (at least) one more fix for v4.{9,14,17}. I'll send out backports
after testing.
Guenter
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 12:20 ` Guenter Roeck
@ 2018-08-15 13:14 ` Greg Kroah-Hartman
0 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-15 13:14 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
lkft-triage, stable
On Wed, Aug 15, 2018 at 05:20:28AM -0700, Guenter Roeck wrote:
> On 08/14/2018 11:14 PM, Greg Kroah-Hartman wrote:
> > On Tue, Aug 14, 2018 at 07:16:23PM +0200, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 4.9.120 release.
> > > There are 107 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
> > > Anything received after that time might be too late.
> > >
> > > The whole patch series can be found in one patch at:
> > > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc1.gz
> >
> > -rc2 is now out:
> > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc2.gz
> >
>
> Heads up: We'll need (at least) one more fix for v4.{9,14,17}. I'll send out backports
> after testing.
Thanks for the fixes, I've queued them up and pushed out a -rc3 for
these 3 trees.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2018-08-15 6:14 ` Greg Kroah-Hartman
@ 2018-08-15 13:12 ` Guenter Roeck
2018-08-15 17:01 ` Sebastian Gottschall
2018-08-15 20:43 ` Dan Rue
105 siblings, 0 replies; 129+ messages in thread
From: Guenter Roeck @ 2018-08-15 13:12 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah, patches, ben.hutchings, lkft-triage, stable
On 08/14/2018 10:16 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.120 release.
> There are 107 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
> Anything received after that time might be too late.
>
For v4.9.119-112-g1a93cfe:
Build results:
total: 148 pass: 146 fail: 2
Failed builds:
i386:allnoconfig
x86_64:allnoconfig
Qemu test results:
total: 289 pass: 289 fail: 0
Details are available at http://kerneltests.org/builders/.
I'll send another report after the fix has been applied and tested.
Guenter
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2018-08-15 13:12 ` Guenter Roeck
@ 2018-08-15 17:01 ` Sebastian Gottschall
2018-08-15 17:52 ` Sven Joachim
2018-08-15 19:11 ` Greg Kroah-Hartman
2018-08-15 20:43 ` Dan Rue
105 siblings, 2 replies; 129+ messages in thread
From: Sebastian Gottschall @ 2018-08-15 17:01 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, shuah, patches, ben.hutchings,
lkft-triage, stable
nother issue seen on xscale and as it affects all non SMP configured kernels
kernel/cpu.c: In function 'boot_cpu_hotplug_init':
kernel/cpu.c:2204:28: error: 'struct cpuhp_cpu_state' has no member
named 'booted_once'
this_cpu_write(cpuhp_state.booted_once, true);
Am 14.08.2018 um 19:16 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 4.9.120 release.
> There are 107 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.120-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 4.9.120-rc1
>
> Josh Poimboeuf <jpoimboe@redhat.com>
> x86/microcode: Allow late microcode loading with SMT disabled
>
> Ashok Raj <ashok.raj@intel.com>
> x86/microcode: Do not upload microcode if CPUs are offline
>
> David Woodhouse <dwmw@amazon.co.uk>
> tools headers: Synchronise x86 cpufeatures.h for L1TF additions
>
> Andi Kleen <ak@linux.intel.com>
> x86/mm/kmmio: Make the tracer robust against L1TF
>
> Andi Kleen <ak@linux.intel.com>
> x86/mm/pat: Make set_memory_np() L1TF safe
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Invert all not present mappings
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Fix SMT supported evaluation
>
> Paolo Bonzini <pbonzini@redhat.com>
> KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/speculation: Simplify sysfs report of VMX L1TF vulnerability
>
> Paolo Bonzini <pbonzini@redhat.com>
> KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR
>
> Wanpeng Li <wanpengli@tencent.com>
> KVM: X86: Allow userspace to define the microcode version
>
> Wanpeng Li <wanpengli@tencent.com>
> KVM: X86: Introduce kvm_get_msr_feature()
>
> Tom Lendacky <thomas.lendacky@amd.com>
> KVM: SVM: Add MSR-based feature support for serializing LFENCE
>
> Tom Lendacky <thomas.lendacky@amd.com>
> KVM: x86: Add a framework for supporting MSR-based features
>
> Thomas Gleixner <tglx@linutronix.de>
> Documentation/l1tf: Remove Yonah processors from not vulnerable list
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr()
>
> Nicolai Stange <nstange@suse.de>
> x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d
>
> Nicolai Stange <nstange@suse.de>
> x86: Don't include linux/irq.h from asm/hardirq.h
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d
>
> Nicolai Stange <nstange@suse.de>
> x86/irq: Demote irq_cpustat_t::__softirq_pending to u16
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond'
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush()
>
> Josh Poimboeuf <jpoimboe@redhat.com>
> cpu/hotplug: detect SMT disabled by BIOS
>
> Tony Luck <tony.luck@intel.com>
> Documentation/l1tf: Fix typos
>
> Nicolai Stange <nstange@suse.de>
> x86/KVM/VMX: Initialize the vmx_l1d_flush_pages' content
>
> Thomas Gleixner <tglx@linutronix.de>
> Documentation: Add section about CPU vulnerabilities
>
> Jiri Kosina <jkosina@suse.cz>
> x86/bugs, kvm: Introduce boot-time control of L1TF mitigations
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early
>
> Jiri Kosina <jkosina@suse.cz>
> cpu/hotplug: Expose SMT control init function
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Allow runtime control of L1D flush
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Serialize L1D flush parameter setter
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Add static key for flush always
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Move l1tf setup function
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/l1tf: Handle EPT disabled state proper
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/kvm: Drop L1TF MSR list approach
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/litf: Introduce vmx status variable
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Online siblings when SMT control is turned on
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Add find_msr() helper function
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers
>
> Jim Mattson <jmattson@google.com>
> kvm: nVMX: Update MSR load counts on a VMCS switch
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/KVM/VMX: Add L1D flush logic
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/KVM/VMX: Add L1D MSR based flush
>
> Paolo Bonzini <pbonzini@redhat.com>
> x86/KVM/VMX: Add L1D flush algorithm
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM/VMX: Add module argument for L1TF mitigation
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Boot HT siblings at least once
>
> Thomas Gleixner <tglx@linutronix.de>
> Revert "x86/apic: Ignore secondary threads if nosmt=force"
>
> Michal Hocko <mhocko@suse.cz>
> x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
>
> Vlastimil Babka <vbabka@suse.cz>
> x86/speculation/l1tf: Protect PAE swap entries against L1TF
>
> Borislav Petkov <bp@suse.de>
> x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/cpufeatures: Add detection of L1D cache flush support.
>
> Vlastimil Babka <vbabka@suse.cz>
> x86/speculation/l1tf: Extend 64bit swap file size limit
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/apic: Ignore secondary threads if nosmt=force
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/AMD: Evaluate smp_num_siblings early
>
> Borislav Petkov <bp@suse.de>
> x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/intel: Evaluate smp_num_siblings early
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/topology: Provide detect_extended_topology_early()
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/common: Provide detect_ht_early()
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu/AMD: Remove the pointless detect_ht() call
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/cpu: Remove the pointless CPU printout
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Provide knobs to control SMT
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Split do_cpu_down()
>
> Thomas Gleixner <tglx@linutronix.de>
> cpu/hotplug: Make bringup/teardown of smp threads symmetric
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/topology: Provide topology_smt_supported()
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/smp: Provide topology_is_primary_thread()
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/bugs: Move the l1tf function and define pr_fmt properly
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Limit swap file size to MAX_PA/2
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Add sysfs reporting for l1tf
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Make sure the first page is always reserved
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
>
> Linus Torvalds <torvalds@linux-foundation.org>
> x86/speculation/l1tf: Protect swap entries against L1TF
>
> Linus Torvalds <torvalds@linux-foundation.org>
> x86/speculation/l1tf: Change order of offset/type in swap entry
>
> Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> mm: x86: move _PAGE_SWP_SOFT_DIRTY from bit 7 to bit 1
>
> Andi Kleen <ak@linux.intel.com>
> x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
>
> Nick Desaulniers <ndesaulniers@google.com>
> x86/irqflags: Provide a declaration for native_save_fl
>
> Masami Hiramatsu <mhiramat@kernel.org>
> kprobes/x86: Fix %p uses in error messages
>
> Jiri Kosina <jkosina@suse.cz>
> x86/speculation: Protect against userspace-userspace spectreRSB
>
> Peter Zijlstra <peterz@infradead.org>
> x86/paravirt: Fix spectre-v2 mitigations for paravirt guests
>
> Oleksij Rempel <o.rempel@pengutronix.de>
> ARM: dts: imx6sx: fix irq for pcie bridge
>
> Michael Mera <dev@michaelmera.com>
> IB/ocrdma: fix out of bounds access to local buffer
>
> Fabio Estevam <fabio.estevam@nxp.com>
> mtd: nand: qcom: Add a NULL check for devm_kasprintf()
>
> Jack Morgenstein <jackm@dev.mellanox.co.il>
> IB/mlx4: Mark user MR as writable if actual virtual memory is writable
>
> Jack Morgenstein <jackm@dev.mellanox.co.il>
> IB/core: Make testing MR flags for writability a static inline function
>
> Eric W. Biederman <ebiederm@xmission.com>
> proc: Fix proc_sys_prune_dcache to hold a sb reference
>
> Eric W. Biederman <ebiederm@xmission.com>
> proc/sysctl: Don't grab i_lock under sysctl_lock.
>
> Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
> proc/sysctl: prune stale dentries during unregistering
>
> Al Viro <viro@zeniv.linux.org.uk>
> fix __legitimize_mnt()/mntput() race
>
> Al Viro <viro@zeniv.linux.org.uk>
> fix mntput/mntput race
>
> Al Viro <viro@zeniv.linux.org.uk>
> make sure that __dentry_kill() always invalidates d_seq, unhashed or not
>
> Al Viro <viro@zeniv.linux.org.uk>
> root dentries need RCU-delayed freeing
>
> Linus Torvalds <torvalds@linux-foundation.org>
> init: rename and re-order boot_cpu_state_init()
>
> Bart Van Assche <bart.vanassche@wdc.com>
> scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices
>
> Juergen Gross <jgross@suse.com>
> xen/netfront: don't cache skb_shinfo()
>
> Linus Torvalds <torvalds@linux-foundation.org>
> Mark HI and TASKLET softirq synchronous
>
> Andrey Konovalov <andreyknvl@google.com>
> kasan: add no_sanitize attribute for clang builds
>
> John David Anglin <dave.anglin@bell.net>
> parisc: Define mb() and add memory barriers to assembler unlock sequences
>
> Helge Deller <deller@gmx.de>
> parisc: Enable CONFIG_MLONGCALLS by default
>
> Tadeusz Struk <tadeusz.struk@intel.com>
> tpm: fix race condition in tpm_common_write()
>
> Theodore Ts'o <tytso@mit.edu>
> ext4: fix check to prevent initializing reserved inodes
>
>
> -------------
>
> Diffstat:
>
> Documentation/ABI/testing/sysfs-devices-system-cpu | 24 +
> Documentation/index.rst | 1 +
> Documentation/kernel-parameters.txt | 78 +++
> Documentation/l1tf.rst | 610 +++++++++++++++++++++
> Documentation/virtual/kvm/api.txt | 40 +-
> Makefile | 4 +-
> arch/Kconfig | 3 +
> arch/arm/boot/dts/imx6sx.dtsi | 2 +-
> arch/parisc/Kconfig | 2 +-
> arch/parisc/include/asm/barrier.h | 32 ++
> arch/parisc/kernel/entry.S | 2 +
> arch/parisc/kernel/pacache.S | 1 +
> arch/parisc/kernel/syscall.S | 4 +
> arch/x86/Kconfig | 1 +
> arch/x86/include/asm/apic.h | 10 +
> arch/x86/include/asm/cpufeatures.h | 4 +-
> arch/x86/include/asm/dmi.h | 2 +-
> arch/x86/include/asm/hardirq.h | 26 +-
> arch/x86/include/asm/irqflags.h | 2 +
> arch/x86/include/asm/kvm_host.h | 9 +
> arch/x86/include/asm/msr-index.h | 7 +
> arch/x86/include/asm/page_32_types.h | 9 +-
> arch/x86/include/asm/pgtable-2level.h | 17 +
> arch/x86/include/asm/pgtable-3level.h | 37 +-
> arch/x86/include/asm/pgtable-invert.h | 32 ++
> arch/x86/include/asm/pgtable.h | 85 ++-
> arch/x86/include/asm/pgtable_64.h | 48 +-
> arch/x86/include/asm/pgtable_types.h | 10 +-
> arch/x86/include/asm/processor.h | 17 +
> arch/x86/include/asm/topology.h | 6 +-
> arch/x86/include/asm/vmx.h | 11 +
> arch/x86/kernel/apic/apic.c | 17 +
> arch/x86/kernel/apic/htirq.c | 2 +
> arch/x86/kernel/apic/io_apic.c | 1 +
> arch/x86/kernel/apic/msi.c | 1 +
> arch/x86/kernel/apic/vector.c | 1 +
> arch/x86/kernel/cpu/amd.c | 53 +-
> arch/x86/kernel/cpu/bugs.c | 171 ++++--
> arch/x86/kernel/cpu/common.c | 56 +-
> arch/x86/kernel/cpu/cpu.h | 2 +
> arch/x86/kernel/cpu/intel.c | 7 +
> arch/x86/kernel/cpu/microcode/core.c | 26 +
> arch/x86/kernel/cpu/topology.c | 41 +-
> arch/x86/kernel/fpu/core.c | 1 +
> arch/x86/kernel/ftrace.c | 1 +
> arch/x86/kernel/hpet.c | 1 +
> arch/x86/kernel/i8259.c | 1 +
> arch/x86/kernel/irq.c | 1 +
> arch/x86/kernel/irq_32.c | 1 +
> arch/x86/kernel/irq_64.c | 1 +
> arch/x86/kernel/irqinit.c | 1 +
> arch/x86/kernel/kprobes/core.c | 5 +-
> arch/x86/kernel/kprobes/opt.c | 1 +
> arch/x86/kernel/paravirt.c | 14 +-
> arch/x86/kernel/setup.c | 6 +
> arch/x86/kernel/smp.c | 1 +
> arch/x86/kernel/smpboot.c | 18 +
> arch/x86/kernel/time.c | 1 +
> arch/x86/kvm/svm.c | 46 +-
> arch/x86/kvm/vmx.c | 426 ++++++++++++--
> arch/x86/kvm/x86.c | 133 ++++-
> arch/x86/mm/fault.c | 1 +
> arch/x86/mm/init.c | 23 +
> arch/x86/mm/kaiser.c | 1 +
> arch/x86/mm/kmmio.c | 25 +-
> arch/x86/mm/mmap.c | 21 +
> arch/x86/mm/pageattr.c | 8 +-
> arch/x86/platform/efi/efi_64.c | 1 +
> arch/x86/platform/efi/quirks.c | 1 +
> .../intel-mid/device_libs/platform_mrfld_wdt.c | 1 +
> arch/x86/platform/uv/tlb_uv.c | 1 +
> arch/x86/xen/enlighten.c | 1 +
> arch/x86/xen/setup.c | 1 +
> drivers/acpi/acpi_lpss.c | 2 +
> drivers/base/cpu.c | 8 +
> drivers/char/tpm/tpm-dev.c | 43 +-
> drivers/infiniband/core/umem.c | 11 +-
> drivers/infiniband/hw/mlx4/mr.c | 50 +-
> drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +-
> drivers/mtd/nand/qcom_nandc.c | 3 +
> drivers/net/xen-netfront.c | 8 +-
> drivers/pci/host/pci-hyperv.c | 2 +
> drivers/scsi/sr.c | 29 +-
> fs/dcache.c | 13 +-
> fs/ext4/ialloc.c | 5 +-
> fs/ext4/super.c | 8 +-
> fs/namespace.c | 28 +-
> fs/proc/inode.c | 3 +-
> fs/proc/internal.h | 7 +-
> fs/proc/proc_sysctl.c | 83 ++-
> include/asm-generic/pgtable.h | 12 +
> include/linux/compiler-clang.h | 3 +
> include/linux/cpu.h | 23 +-
> include/linux/swapfile.h | 2 +
> include/linux/sysctl.h | 1 +
> include/rdma/ib_verbs.h | 14 +
> include/uapi/linux/kvm.h | 2 +
> init/main.c | 2 +-
> kernel/cpu.c | 282 +++++++++-
> kernel/smp.c | 2 +
> kernel/softirq.c | 12 +-
> mm/memory.c | 29 +-
> mm/mprotect.c | 49 ++
> mm/swapfile.c | 46 +-
> tools/arch/x86/include/asm/cpufeatures.h | 4 +-
> 105 files changed, 2680 insertions(+), 366 deletions(-)
>
>
>
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 17:01 ` Sebastian Gottschall
@ 2018-08-15 17:52 ` Sven Joachim
2018-08-15 18:22 ` Sebastian Gottschall
2018-08-15 18:27 ` Sebastian Gottschall
2018-08-15 19:11 ` Greg Kroah-Hartman
1 sibling, 2 replies; 129+ messages in thread
From: Sven Joachim @ 2018-08-15 17:52 UTC (permalink / raw)
To: Sebastian Gottschall
Cc: Greg Kroah-Hartman, linux-kernel, torvalds, akpm, linux, shuah,
patches, ben.hutchings, lkft-triage, stable
On 2018-08-15 19:01 +0200, Sebastian Gottschall wrote:
> nother issue seen on xscale and as it affects all non SMP configured kernels
>
>
> kernel/cpu.c: In function 'boot_cpu_hotplug_init':
> kernel/cpu.c:2204:28: error: 'struct cpuhp_cpu_state' has no member
> named 'booted_once'
> this_cpu_write(cpuhp_state.booted_once, true);
I got a different error in 4.9.120 with CONFIG_SMP unset:
,----
| CC drivers/rtc/rtc-cmos.o
| In file included from drivers/rtc/rtc-cmos.c:45:0:
| ./arch/x86/include/asm/i8259.h: In function 'inb_pic':
| ./arch/x86/include/asm/i8259.h:32:24: error: implicit declaration of function 'inb' [-Werror=implicit-function-declaration]
| unsigned char value = inb(port);
| ^~~
| ./arch/x86/include/asm/i8259.h: In function 'outb_pic':
| ./arch/x86/include/asm/i8259.h:45:2: error: implicit declaration of function 'outb' [-Werror=implicit-function-declaration]
| outb(value, port);
| ^~~~
| In file included from ./include/linux/mc146818rtc.h:14:0,
| from drivers/rtc/rtc-cmos.c:49:
| ./arch/x86/include/asm/io.h: At top level:
| ./arch/x86/include/asm/io.h:277:20: warning: conflicting types for 'outb'
| static inline void out##bwl(unsigned type value, int port) \
| ^
| ./arch/x86/include/asm/io.h:316:1: note: in expansion of macro 'BUILDIO'
| BUILDIO(b, b, char)
| ^~~~~~~
| ./arch/x86/include/asm/io.h:277:20: error: static declaration of 'outb' follows non-static declaration
| static inline void out##bwl(unsigned type value, int port) \
| ^
| ./arch/x86/include/asm/io.h:316:1: note: in expansion of macro 'BUILDIO'
| BUILDIO(b, b, char)
| ^~~~~~~
| In file included from drivers/rtc/rtc-cmos.c:45:0:
| ./arch/x86/include/asm/i8259.h:45:2: note: previous implicit declaration of 'outb' was here
| outb(value, port);
| ^~~~
| In file included from ./include/linux/mc146818rtc.h:14:0,
| from drivers/rtc/rtc-cmos.c:49:
| ./arch/x86/include/asm/io.h:283:29: error: conflicting types for 'inb'
| static inline unsigned type in##bwl(int port) \
| ^
| ./arch/x86/include/asm/io.h:316:1: note: in expansion of macro 'BUILDIO'
| BUILDIO(b, b, char)
| ^~~~~~~
| In file included from drivers/rtc/rtc-cmos.c:45:0:
| ./arch/x86/include/asm/i8259.h:32:24: note: previous implicit declaration of 'inb' was here
| unsigned char value = inb(port);
`----
Cheers,
Sven
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 17:52 ` Sven Joachim
@ 2018-08-15 18:22 ` Sebastian Gottschall
2018-08-15 18:26 ` Linus Torvalds
2018-08-15 18:27 ` Sebastian Gottschall
1 sibling, 1 reply; 129+ messages in thread
From: Sebastian Gottschall @ 2018-08-15 18:22 UTC (permalink / raw)
To: Sven Joachim
Cc: Greg Kroah-Hartman, linux-kernel, torvalds, akpm, linux, shuah,
patches, ben.hutchings, lkft-triage, stable
Am 15.08.2018 um 19:52 schrieb Sven Joachim:
> On 2018-08-15 19:01 +0200, Sebastian Gottschall wrote:
>
>> nother issue seen on xscale and as it affects all non SMP configured kernels
>>
>>
>> kernel/cpu.c: In function 'boot_cpu_hotplug_init':
>> kernel/cpu.c:2204:28: error: 'struct cpuhp_cpu_state' has no member
>> named 'booted_once'
>> this_cpu_write(cpuhp_state.booted_once, true);
> I got a different error in 4.9.120 with CONFIG_SMP unset:
that doesnt make it better :-) i havend checked x86 without smp, just
xscale. your error doesnt affect xscale which is a arm platform. all
these issues seem to affect 4.14 as well
btw. i found another compile error with x86 :-)
arch/x86/kernel/apic/apic.c:2050:6: error: redefinition of
'apic_id_is_primary_thread'
bool apic_id_is_primary_thread(unsigned int apicid)
^~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ./arch/x86/include/asm/smp.h:12,
from ./arch/x86/include/asm/tlbflush.h:10,
from ./arch/x86/include/asm/highmem.h:26,
from ./include/linux/highmem.h:34,
from ./include/linux/pagemap.h:10,
from ./arch/x86/include/asm/pgalloc.h:6,
from arch/x86/kernel/apic/apic.c:43:
./arch/x86/include/asm/apic.h:641:20: note: previous definition of
'apic_id_is_primary_thread' was here
static inline bool apic_id_is_primary_thread(unsigned int id) { return
false; }
Sebastian
>
> ,----
> | CC drivers/rtc/rtc-cmos.o
> | In file included from drivers/rtc/rtc-cmos.c:45:0:
> | ./arch/x86/include/asm/i8259.h: In function 'inb_pic':
> | ./arch/x86/include/asm/i8259.h:32:24: error: implicit declaration of function 'inb' [-Werror=implicit-function-declaration]
> | unsigned char value = inb(port);
> | ^~~
> | ./arch/x86/include/asm/i8259.h: In function 'outb_pic':
> | ./arch/x86/include/asm/i8259.h:45:2: error: implicit declaration of function 'outb' [-Werror=implicit-function-declaration]
> | outb(value, port);
> | ^~~~
> | In file included from ./include/linux/mc146818rtc.h:14:0,
> | from drivers/rtc/rtc-cmos.c:49:
> | ./arch/x86/include/asm/io.h: At top level:
> | ./arch/x86/include/asm/io.h:277:20: warning: conflicting types for 'outb'
> | static inline void out##bwl(unsigned type value, int port) \
> | ^
> | ./arch/x86/include/asm/io.h:316:1: note: in expansion of macro 'BUILDIO'
> | BUILDIO(b, b, char)
> | ^~~~~~~
> | ./arch/x86/include/asm/io.h:277:20: error: static declaration of 'outb' follows non-static declaration
> | static inline void out##bwl(unsigned type value, int port) \
> | ^
> | ./arch/x86/include/asm/io.h:316:1: note: in expansion of macro 'BUILDIO'
> | BUILDIO(b, b, char)
> | ^~~~~~~
> | In file included from drivers/rtc/rtc-cmos.c:45:0:
> | ./arch/x86/include/asm/i8259.h:45:2: note: previous implicit declaration of 'outb' was here
> | outb(value, port);
> | ^~~~
> | In file included from ./include/linux/mc146818rtc.h:14:0,
> | from drivers/rtc/rtc-cmos.c:49:
> | ./arch/x86/include/asm/io.h:283:29: error: conflicting types for 'inb'
> | static inline unsigned type in##bwl(int port) \
> | ^
> | ./arch/x86/include/asm/io.h:316:1: note: in expansion of macro 'BUILDIO'
> | BUILDIO(b, b, char)
> | ^~~~~~~
> | In file included from drivers/rtc/rtc-cmos.c:45:0:
> | ./arch/x86/include/asm/i8259.h:32:24: note: previous implicit declaration of 'inb' was here
> | unsigned char value = inb(port);
> `----
>
> Cheers,
> Sven
>
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 18:22 ` Sebastian Gottschall
@ 2018-08-15 18:26 ` Linus Torvalds
2018-08-15 18:33 ` Sebastian Gottschall
0 siblings, 1 reply; 129+ messages in thread
From: Linus Torvalds @ 2018-08-15 18:26 UTC (permalink / raw)
To: s.gottschall
Cc: Sven Joachim, Greg Kroah-Hartman, Linux Kernel Mailing List,
Andrew Morton, Guenter Roeck, Shuah Khan, patches, Ben Hutchings,
lkft-triage, stable
On Wed, Aug 15, 2018 at 11:22 AM Sebastian Gottschall
<s.gottschall@dd-wrt.com> wrote:
>
> btw. i found another compile error with x86 :-)
This should already be fixed by commit d0055f351e64 ("x86/smp: fix
non-SMP broken build due to redefinition of
apic_id_is_primary_thread").
Linus
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 18:26 ` Linus Torvalds
@ 2018-08-15 18:33 ` Sebastian Gottschall
2018-08-15 19:10 ` Greg Kroah-Hartman
0 siblings, 1 reply; 129+ messages in thread
From: Sebastian Gottschall @ 2018-08-15 18:33 UTC (permalink / raw)
To: Linus Torvalds
Cc: Sven Joachim, Greg Kroah-Hartman, Linux Kernel Mailing List,
Andrew Morton, Guenter Roeck, Shuah Khan, patches, Ben Hutchings,
lkft-triage, stable
Am 15.08.2018 um 20:26 schrieb Linus Torvalds:
> On Wed, Aug 15, 2018 at 11:22 AM Sebastian Gottschall
> <s.gottschall@dd-wrt.com> wrote:
>> btw. i found another compile error with x86 :-)
> This should already be fixed by commit d0055f351e64 ("x86/smp: fix
> non-SMP broken build due to redefinition of
> apic_id_is_primary_thread").
>
> Linus
Hello Linus
unfortunatly there are numerous other non smp compile issues. this patch
covers just one out of 3 found so far
Sebastian
>
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 18:33 ` Sebastian Gottschall
@ 2018-08-15 19:10 ` Greg Kroah-Hartman
0 siblings, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-15 19:10 UTC (permalink / raw)
To: Sebastian Gottschall
Cc: Linus Torvalds, Sven Joachim, Linux Kernel Mailing List,
Andrew Morton, Guenter Roeck, Shuah Khan, patches, Ben Hutchings,
lkft-triage, stable
On Wed, Aug 15, 2018 at 08:33:30PM +0200, Sebastian Gottschall wrote:
>
> Am 15.08.2018 um 20:26 schrieb Linus Torvalds:
> > On Wed, Aug 15, 2018 at 11:22 AM Sebastian Gottschall
> > <s.gottschall@dd-wrt.com> wrote:
> > > btw. i found another compile error with x86 :-)
> > This should already be fixed by commit d0055f351e64 ("x86/smp: fix
> > non-SMP broken build due to redefinition of
> > apic_id_is_primary_thread").
> >
> > Linus
>
> Hello Linus
>
> unfortunatly there are numerous other non smp compile issues. this patch
> covers just one out of 3 found so far
Do you have patches for the others? Non smp builds are pretty rare
these days :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 17:52 ` Sven Joachim
2018-08-15 18:22 ` Sebastian Gottschall
@ 2018-08-15 18:27 ` Sebastian Gottschall
2018-08-15 18:55 ` Guenter Roeck
2018-08-15 19:14 ` Greg Kroah-Hartman
1 sibling, 2 replies; 129+ messages in thread
From: Sebastian Gottschall @ 2018-08-15 18:27 UTC (permalink / raw)
To: Sven Joachim
Cc: Greg Kroah-Hartman, linux-kernel, torvalds, akpm, linux, shuah,
patches, ben.hutchings, lkft-triage, stable
if i fix the other error (can be reproduced with disable smp on standard
i386 build)
another raises up again related to smp. to be serious. this patchset of
x86 patches is absolutelly broken and put together without any care. not
a simple compile test has been done
sorry for beeing a little bit upset. i'm sure i will find other bugs if
i go deeper
arch/x86/kernel/cpu/amd.c: In function 'early_init_amd':
arch/x86/kernel/cpu/amd.c:660:2: error: implicit declaration of function
'amd_get_topology_early'; did you mean 'cpu_smt_check_topology_early'?
[-Werror=implicit-function-declaration]
amd_get_topology_early(c);
^~~~~~~~~~~~~~~~~~~~~~
cpu_smt_check_topology_early
Am 15.08.2018 um 19:52 schrieb Sven Joachim:
> On 2018-08-15 19:01 +0200, Sebastian Gottschall wrote:
>
>> nother issue seen on xscale and as it affects all non SMP configured kernels
>>
>>
>> kernel/cpu.c: In function 'boot_cpu_hotplug_init':
>> kernel/cpu.c:2204:28: error: 'struct cpuhp_cpu_state' has no member
>> named 'booted_once'
>> this_cpu_write(cpuhp_state.booted_once, true);
> I got a different error in 4.9.120 with CONFIG_SMP unset:
>
> ,----
> | CC drivers/rtc/rtc-cmos.o
> | In file included from drivers/rtc/rtc-cmos.c:45:0:
> | ./arch/x86/include/asm/i8259.h: In function 'inb_pic':
> | ./arch/x86/include/asm/i8259.h:32:24: error: implicit declaration of function 'inb' [-Werror=implicit-function-declaration]
> | unsigned char value = inb(port);
> | ^~~
> | ./arch/x86/include/asm/i8259.h: In function 'outb_pic':
> | ./arch/x86/include/asm/i8259.h:45:2: error: implicit declaration of function 'outb' [-Werror=implicit-function-declaration]
> | outb(value, port);
> | ^~~~
> | In file included from ./include/linux/mc146818rtc.h:14:0,
> | from drivers/rtc/rtc-cmos.c:49:
> | ./arch/x86/include/asm/io.h: At top level:
> | ./arch/x86/include/asm/io.h:277:20: warning: conflicting types for 'outb'
> | static inline void out##bwl(unsigned type value, int port) \
> | ^
> | ./arch/x86/include/asm/io.h:316:1: note: in expansion of macro 'BUILDIO'
> | BUILDIO(b, b, char)
> | ^~~~~~~
> | ./arch/x86/include/asm/io.h:277:20: error: static declaration of 'outb' follows non-static declaration
> | static inline void out##bwl(unsigned type value, int port) \
> | ^
> | ./arch/x86/include/asm/io.h:316:1: note: in expansion of macro 'BUILDIO'
> | BUILDIO(b, b, char)
> | ^~~~~~~
> | In file included from drivers/rtc/rtc-cmos.c:45:0:
> | ./arch/x86/include/asm/i8259.h:45:2: note: previous implicit declaration of 'outb' was here
> | outb(value, port);
> | ^~~~
> | In file included from ./include/linux/mc146818rtc.h:14:0,
> | from drivers/rtc/rtc-cmos.c:49:
> | ./arch/x86/include/asm/io.h:283:29: error: conflicting types for 'inb'
> | static inline unsigned type in##bwl(int port) \
> | ^
> | ./arch/x86/include/asm/io.h:316:1: note: in expansion of macro 'BUILDIO'
> | BUILDIO(b, b, char)
> | ^~~~~~~
> | In file included from drivers/rtc/rtc-cmos.c:45:0:
> | ./arch/x86/include/asm/i8259.h:32:24: note: previous implicit declaration of 'inb' was here
> | unsigned char value = inb(port);
> `----
>
> Cheers,
> Sven
>
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 18:27 ` Sebastian Gottschall
@ 2018-08-15 18:55 ` Guenter Roeck
2018-08-15 19:08 ` Sebastian Gottschall
2018-08-15 19:14 ` Greg Kroah-Hartman
1 sibling, 1 reply; 129+ messages in thread
From: Guenter Roeck @ 2018-08-15 18:55 UTC (permalink / raw)
To: Sebastian Gottschall
Cc: Sven Joachim, Greg Kroah-Hartman, linux-kernel, torvalds, akpm,
shuah, patches, ben.hutchings, lkft-triage, stable
On Wed, Aug 15, 2018 at 08:27:00PM +0200, Sebastian Gottschall wrote:
> if i fix the other error (can be reproduced with disable smp on standard
> i386 build)
>
> another raises up again related to smp. to be serious. this patchset of x86
> patches is absolutelly broken and put together without any care. not a
> simple compile test has been done
>
> sorry for beeing a little bit upset. i'm sure i will find other bugs if i go
> deeper
>
It might possibly help if you would consider to publish your configuration(s).
As for "not a simple compile test has been done", please have a look
at http://kerneltests.org/builders. I guess those compile (and boot)
tests don't count as "simple". I assume the same applies to all the
builds done by 0day and all the other test builders.
Guenter
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 18:55 ` Guenter Roeck
@ 2018-08-15 19:08 ` Sebastian Gottschall
2018-08-15 19:26 ` Guenter Roeck
0 siblings, 1 reply; 129+ messages in thread
From: Sebastian Gottschall @ 2018-08-15 19:08 UTC (permalink / raw)
To: Guenter Roeck
Cc: Sven Joachim, Greg Kroah-Hartman, linux-kernel, torvalds, akpm,
shuah, patches, ben.hutchings, lkft-triage, stable
Am 15.08.2018 um 20:55 schrieb Guenter Roeck:
> On Wed, Aug 15, 2018 at 08:27:00PM +0200, Sebastian Gottschall wrote:
>> if i fix the other error (can be reproduced with disable smp on standard
>> i386 build)
>>
>> another raises up again related to smp. to be serious. this patchset of x86
>> patches is absolutelly broken and put together without any care. not a
>> simple compile test has been done
>>
>> sorry for beeing a little bit upset. i'm sure i will find other bugs if i go
>> deeper
>>
> It might possibly help if you would consider to publish your configuration(s).
>
> As for "not a simple compile test has been done", please have a look
> at http://kerneltests.org/builders. I guess those compile (and boot)
> tests don't count as "simple". I assume the same applies to all the
> builds done by 0day and all the other test builders.
>
> Guenter
it was nothing special. just a standard x86 build with smp disabled.
that triggers all of them. so this should be a common build
configuration for testing
these issues are covered by the rc3 patch of 4.9 right now
the issue reported by sven can be triggered by just compiling rtc-cmos.c
which is caused by the change in dmi.h (asm/io.h was replaced by
linux/io.h)
so this driver should be included in all x86 and x64 builds and must be
uncovered in any simple compile test
btw. this issue is still unresolved but simple to fix
--- arch/x86/include/asm/i8259.h (revision 36620)
+++ arch/x86/include/asm/i8259.h (working copy)
@@ -2,6 +2,7 @@
#define _ASM_X86_I8259_H
#include <linux/delay.h>
+#include <asm/io.h>
extern unsigned int cached_irq_mask;
Sebastian
>
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 19:08 ` Sebastian Gottschall
@ 2018-08-15 19:26 ` Guenter Roeck
2018-08-15 19:42 ` Linus Torvalds
0 siblings, 1 reply; 129+ messages in thread
From: Guenter Roeck @ 2018-08-15 19:26 UTC (permalink / raw)
To: Sebastian Gottschall
Cc: Sven Joachim, Greg Kroah-Hartman, linux-kernel, torvalds, akpm,
shuah, patches, ben.hutchings, lkft-triage, stable
On Wed, Aug 15, 2018 at 09:08:08PM +0200, Sebastian Gottschall wrote:
>
> Am 15.08.2018 um 20:55 schrieb Guenter Roeck:
> >On Wed, Aug 15, 2018 at 08:27:00PM +0200, Sebastian Gottschall wrote:
> >>if i fix the other error (can be reproduced with disable smp on standard
> >>i386 build)
> >>
> >>another raises up again related to smp. to be serious. this patchset of x86
> >>patches is absolutelly broken and put together without any care. not a
> >>simple compile test has been done
> >>
> >>sorry for beeing a little bit upset. i'm sure i will find other bugs if i go
> >>deeper
> >>
> >It might possibly help if you would consider to publish your configuration(s).
> >
> >As for "not a simple compile test has been done", please have a look
> >at http://kerneltests.org/builders. I guess those compile (and boot)
> >tests don't count as "simple". I assume the same applies to all the
> >builds done by 0day and all the other test builders.
> >
> >Guenter
>
> it was nothing special. just a standard x86 build with smp disabled. that
> triggers all of them. so this should be a common build configuration for
> testing
> these issues are covered by the rc3 patch of 4.9 right now
>
> the issue reported by sven can be triggered by just compiling rtc-cmos.c
> which is caused by the change in dmi.h (asm/io.h was replaced by
> linux/io.h)
> so this driver should be included in all x86 and x64 builds and must be
> uncovered in any simple compile test
>
> btw. this issue is still unresolved but simple to fix
>
> --- arch/x86/include/asm/i8259.h (revision 36620)
> +++ arch/x86/include/asm/i8259.h (working copy)
> @@ -2,6 +2,7 @@
> #define _ASM_X86_I8259_H
>
> #include <linux/delay.h>
> +#include <asm/io.h>
>
Also seen in mainline. Meaning my non-SMP test builds are broken. Hmm.
Anyway, care to send a proper patch ? I am sure Linus will be more
than happy to apply it.
Thanks,
Guenter
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 19:26 ` Guenter Roeck
@ 2018-08-15 19:42 ` Linus Torvalds
2018-08-15 20:33 ` Sebastian Gottschall
2018-08-15 20:40 ` Guenter Roeck
0 siblings, 2 replies; 129+ messages in thread
From: Linus Torvalds @ 2018-08-15 19:42 UTC (permalink / raw)
To: Guenter Roeck
Cc: s.gottschall, Sven Joachim, Greg Kroah-Hartman,
Linux Kernel Mailing List, Andrew Morton, Shuah Khan, patches,
Ben Hutchings, lkft-triage, stable
On Wed, Aug 15, 2018 at 12:26 PM Guenter Roeck <linux@roeck-us.net> wrote:
>
> Also seen in mainline. Meaning my non-SMP test builds are broken. Hmm.
Grr. I think it's due mainly due to commit 447ae3166702 ("x86: Don't
include linux/irq.h from asm/hardirq.h"), which exposes a number of
files that had some dodgy include file dependenencies, and just
randomly happened to get it right because of that odd include that
caused problems.
That commit itself is definitely the right thing to do, but yes, we
clearly had a lot of cases of things getting core header files
included purely by luck.
And because this was all done under embargo, we didn't get the kind of
test robot coverage we usually get.
Part of it can also be due to subtle merge issues - even if the
original branch got good coverage, later changes sometimes ended up
adding things like that.
For example, my merge of the L1TF code found that in the meantime,
arch/x86/kernel/kvmclock.c had added a call to kzalloc(), which used
to work just fine, but with the header cleanup it turned out that
kvmclock.c had never included <linux/slab.h>, so now it didn't build
right.
And that was just the one I noticed because of my limited build tests.
And yes, every single developer has CONFIG_SMP in their config, but
perhaps equally importantly, I suspect CONFIG_SMP ends up getting more
header files included almost by mistake, so it can _continue_ to hide
these kinds of incomplete header file includes that just happen to
work.
> Anyway, care to send a proper patch ? I am sure Linus will be more
> than happy to apply it.
I think "happy" is too strong a word for my state of mind with all
this, but yes, I'll apply it, and you'll get the glory of fixing some
configuration that clearly didn't get properly tested.
In the meantime, maybe I should just do a "make allmodconfig" and then
disable SMP and see if that shows anything for me.
Linus
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 19:42 ` Linus Torvalds
@ 2018-08-15 20:33 ` Sebastian Gottschall
2018-08-15 20:42 ` Linus Torvalds
2018-08-15 20:40 ` Guenter Roeck
1 sibling, 1 reply; 129+ messages in thread
From: Sebastian Gottschall @ 2018-08-15 20:33 UTC (permalink / raw)
To: Linus Torvalds, Guenter Roeck
Cc: Sven Joachim, Greg Kroah-Hartman, Linux Kernel Mailing List,
Andrew Morton, Shuah Khan, patches, Ben Hutchings, lkft-triage,
stable
Am 15.08.2018 um 21:42 schrieb Linus Torvalds:
> On Wed, Aug 15, 2018 at 12:26 PM Guenter Roeck <linux@roeck-us.net> wrote:
>> Also seen in mainline. Meaning my non-SMP test builds are broken. Hmm.
> Grr. I think it's due mainly due to commit 447ae3166702 ("x86: Don't
> include linux/irq.h from asm/hardirq.h"), which exposes a number of
> files that had some dodgy include file dependenencies, and just
> randomly happened to get it right because of that odd include that
> caused problems.
correct.
>
> That commit itself is definitely the right thing to do, but yes, we
> clearly had a lot of cases of things getting core header files
> included purely by luck.
>
> And because this was all done under embargo, we didn't get the kind of
> test robot coverage we usually get.
>
> Part of it can also be due to subtle merge issues - even if the
> original branch got good coverage, later changes sometimes ended up
> adding things like that.
>
> For example, my merge of the L1TF code found that in the meantime,
> arch/x86/kernel/kvmclock.c had added a call to kzalloc(), which used
> to work just fine, but with the header cleanup it turned out that
> kvmclock.c had never included <linux/slab.h>, so now it didn't build
> right.
>
> And that was just the one I noticed because of my limited build tests.
>
> And yes, every single developer has CONFIG_SMP in their config, but
> perhaps equally importantly, I suspect CONFIG_SMP ends up getting more
> header files included almost by mistake, so it can _continue_ to hide
> these kinds of incomplete header file includes that just happen to
> work.
>
>> Anyway, care to send a proper patch ? I am sure Linus will be more
>> than happy to apply it.
> I think "happy" is too strong a word for my state of mind with all
> this, but yes, I'll apply it, and you'll get the glory of fixing some
> configuration that clearly didn't get properly tested.
>
> In the meantime, maybe I should just do a "make allmodconfig" and then
> disable SMP and see if that shows anything for me.
if it would be helpfull i can do this quick here using the latest
vanilla tree
Sebastian
>
> Linus
>
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 20:33 ` Sebastian Gottschall
@ 2018-08-15 20:42 ` Linus Torvalds
2018-08-16 7:03 ` Sebastian Gottschall
0 siblings, 1 reply; 129+ messages in thread
From: Linus Torvalds @ 2018-08-15 20:42 UTC (permalink / raw)
To: s.gottschall
Cc: Guenter Roeck, Sven Joachim, Greg Kroah-Hartman,
Linux Kernel Mailing List, Andrew Morton, Shuah Khan, patches,
Ben Hutchings, lkft-triage, stable
On Wed, Aug 15, 2018 at 1:33 PM Sebastian Gottschall
<s.gottschall@dd-wrt.com> wrote:
>
> if it would be helpfull i can do this quick here using the latest
> vanilla tree
It would definitely be helpful, since I'm already quite busy with the
normal merge window work. Having the embargo for L1TF end just as the
merge window opened wasn't all that convenient.
Of course, I have my own "I will delay 4.18 by a week" to blame for the timing.
So if you can find the places that break, and add the right header,
and send me a patch for all the ones you find, that would be lovely.
It's not necessarilky always <linux/io.h> or <linux/irq.h> that makes
sense to add as an include. As mentioned, sometimes it's
<linux/slab.h> or similar.
Linus
^ permalink raw reply [flat|nested] 129+ messages in thread* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 20:42 ` Linus Torvalds
@ 2018-08-16 7:03 ` Sebastian Gottschall
0 siblings, 0 replies; 129+ messages in thread
From: Sebastian Gottschall @ 2018-08-16 7:03 UTC (permalink / raw)
To: Linus Torvalds
Cc: Guenter Roeck, Sven Joachim, Greg Kroah-Hartman,
Linux Kernel Mailing List, Andrew Morton, Shuah Khan, patches,
Ben Hutchings, lkft-triage, stable
Am 15.08.2018 um 22:42 schrieb Linus Torvalds:
>
> It would definitely be helpful, since I'm already quite busy with the
> normal merge window work. Having the embargo for L1TF end just as the
> merge window opened wasn't all that convenient.
all good so far. i checked them all and i will see how my nightly build
goes out which does compilation on alot of
mips, arm, powerpc etc. platforms
>
> Of course, I have my own "I will delay 4.18 by a week" to blame for the timing.
>
> So if you can find the places that break, and add the right header,
> and send me a patch for all the ones you find, that would be lovely.
will do so. but for now it seems that this was really the only one
>
> It's not necessarilky always <linux/io.h> or <linux/irq.h> that makes
> sense to add as an include. As mentioned, sometimes it's
> <linux/slab.h> or similar.
mmh why? i prefer to include the correct header which references the
function or macro instead of adding
a header which finds the right way by multiple iterations. its more
transparent
Sebastian
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 19:42 ` Linus Torvalds
2018-08-15 20:33 ` Sebastian Gottschall
@ 2018-08-15 20:40 ` Guenter Roeck
1 sibling, 0 replies; 129+ messages in thread
From: Guenter Roeck @ 2018-08-15 20:40 UTC (permalink / raw)
To: Linus Torvalds
Cc: s.gottschall, Sven Joachim, Greg Kroah-Hartman,
Linux Kernel Mailing List, Andrew Morton, Shuah Khan, patches,
Ben Hutchings, lkft-triage, stable
On Wed, Aug 15, 2018 at 12:42:27PM -0700, Linus Torvalds wrote:
> On Wed, Aug 15, 2018 at 12:26 PM Guenter Roeck <linux@roeck-us.net> wrote:
> >
> > Also seen in mainline. Meaning my non-SMP test builds are broken. Hmm.
>
> Grr. I think it's due mainly due to commit 447ae3166702 ("x86: Don't
Yes. It was a side effect of adding many more boot tests. Now fixed.
Too late of course.
> include linux/irq.h from asm/hardirq.h"), which exposes a number of
> files that had some dodgy include file dependenencies, and just
> randomly happened to get it right because of that odd include that
> caused problems.
>
> That commit itself is definitely the right thing to do, but yes, we
> clearly had a lot of cases of things getting core header files
> included purely by luck.
>
> And because this was all done under embargo, we didn't get the kind of
> test robot coverage we usually get.
>
> Part of it can also be due to subtle merge issues - even if the
> original branch got good coverage, later changes sometimes ended up
> adding things like that.
>
> For example, my merge of the L1TF code found that in the meantime,
> arch/x86/kernel/kvmclock.c had added a call to kzalloc(), which used
> to work just fine, but with the header cleanup it turned out that
> kvmclock.c had never included <linux/slab.h>, so now it didn't build
> right.
>
> And that was just the one I noticed because of my limited build tests.
>
> And yes, every single developer has CONFIG_SMP in their config, but
> perhaps equally importantly, I suspect CONFIG_SMP ends up getting more
> header files included almost by mistake, so it can _continue_ to hide
> these kinds of incomplete header file includes that just happen to
> work.
>
> > Anyway, care to send a proper patch ? I am sure Linus will be more
> > than happy to apply it.
>
> I think "happy" is too strong a word for my state of mind with all
> this, but yes, I'll apply it, and you'll get the glory of fixing some
> configuration that clearly didn't get properly tested.
>
I went ahead and submitted a patch, with proper attribution. Let me know
if you didn't get it.
> In the meantime, maybe I should just do a "make allmodconfig" and then
> disable SMP and see if that shows anything for me.
>
I did that and didn't find any other errors.
Guenter
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 18:27 ` Sebastian Gottschall
2018-08-15 18:55 ` Guenter Roeck
@ 2018-08-15 19:14 ` Greg Kroah-Hartman
1 sibling, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-15 19:14 UTC (permalink / raw)
To: Sebastian Gottschall
Cc: Sven Joachim, linux-kernel, torvalds, akpm, linux, shuah,
patches, ben.hutchings, lkft-triage, stable
On Wed, Aug 15, 2018 at 08:27:00PM +0200, Sebastian Gottschall wrote:
> if i fix the other error (can be reproduced with disable smp on standard
> i386 build)
>
> another raises up again related to smp. to be serious. this patchset of x86
> patches is absolutelly broken and put together without any care. not a
> simple compile test has been done
That's just not true at all. Gift horse, mouth.
> sorry for beeing a little bit upset. i'm sure i will find other bugs if i go
> deeper
Testing is always great to have. Perhaps just move to 4.14.y or Linus's
tree if 4.9 does not work for you? THere's only so much testing we
could do before the embargo, sorry. We are very lucky to even have
these patches for 4.9 in the first place.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-15 17:01 ` Sebastian Gottschall
2018-08-15 17:52 ` Sven Joachim
@ 2018-08-15 19:11 ` Greg Kroah-Hartman
1 sibling, 0 replies; 129+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-15 19:11 UTC (permalink / raw)
To: Sebastian Gottschall
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Wed, Aug 15, 2018 at 07:01:38PM +0200, Sebastian Gottschall wrote:
> nother issue seen on xscale and as it affects all non SMP configured kernels
>
>
> kernel/cpu.c: In function 'boot_cpu_hotplug_init':
> kernel/cpu.c:2204:28: error: 'struct cpuhp_cpu_state' has no member named
> 'booted_once'
> this_cpu_write(cpuhp_state.booted_once, true);
Is this also in Linus's tree?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 129+ messages in thread
* Re: [PATCH 4.9 000/107] 4.9.120-stable review
2018-08-14 17:16 [PATCH 4.9 000/107] 4.9.120-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2018-08-15 17:01 ` Sebastian Gottschall
@ 2018-08-15 20:43 ` Dan Rue
105 siblings, 0 replies; 129+ messages in thread
From: Dan Rue @ 2018-08-15 20:43 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Tue, Aug 14, 2018 at 07:16:23PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.120 release.
> There are 107 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Aug 16 17:14:53 UTC 2018.
> Anything received after that time might be too late.
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.9.120-rc2
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: 1a93cfe683918b90ca033d21080a2990cc25b6df
git describe: v4.9.119-112-g1a93cfe68391
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.119-112-g1a93cfe68391
No regressions (compared to build v4.9.119)
Ran 12080 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-cve-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
* ltp-open-posix-tests
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 129+ messages in thread