Commit d396360a authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:
 "Misc fixes and updates:

   - a handful of MDS documentation/comment updates

   - a cleanup related to hweight interfaces

   - a SEV guest fix for large pages

   - a kprobes LTO fix

   - and a final cleanup commit for vDSO HPET support removal"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/speculation/mds: Improve CPU buffer clear documentation
  x86/speculation/mds: Revert CPU buffer clear on double fault exit
  x86/kconfig: Disable CONFIG_GENERIC_HWEIGHT and remove __HAVE_ARCH_SW_HWEIGHT
  x86/mm: Do not use set_{pud, pmd}_safe() when splitting a large page
  x86/kprobes: Make trampoline_handler() global and visible
  x86/vdso: Remove hpet_page from vDSO
parents b2c3dda6 9d8d0294
...@@ -142,45 +142,13 @@ Mitigation points ...@@ -142,45 +142,13 @@ Mitigation points
mds_user_clear. mds_user_clear.
The mitigation is invoked in prepare_exit_to_usermode() which covers The mitigation is invoked in prepare_exit_to_usermode() which covers
most of the kernel to user space transitions. There are a few exceptions all but one of the kernel to user space transitions. The exception
which are not invoking prepare_exit_to_usermode() on return to user is when we return from a Non Maskable Interrupt (NMI), which is
space. These exceptions use the paranoid exit code. handled directly in do_nmi().
- Non Maskable Interrupt (NMI): (The reason that NMI is special is that prepare_exit_to_usermode() can
enable IRQs. In NMI context, NMIs are blocked, and we don't want to
Access to sensible data like keys, credentials in the NMI context is enable IRQs with NMIs blocked.)
mostly theoretical: The CPU can do prefetching or execute a
misspeculated code path and thereby fetching data which might end up
leaking through a buffer.
But for mounting other attacks the kernel stack address of the task is
already valuable information. So in full mitigation mode, the NMI is
mitigated on the return from do_nmi() to provide almost complete
coverage.
- Double fault (#DF):
A double fault is usually fatal, but the ESPFIX workaround, which can
be triggered from user space through modify_ldt(2) is a recoverable
double fault. #DF uses the paranoid exit path, so explicit mitigation
in the double fault handler is required.
- Machine Check Exception (#MC):
Another corner case is a #MC which hits between the CPU buffer clear
invocation and the actual return to user. As this still is in kernel
space it takes the paranoid exit path which does not clear the CPU
buffers. So the #MC handler repopulates the buffers to some
extent. Machine checks are not reliably controllable and the window is
extremly small so mitigation would just tick a checkbox that this
theoretical corner case is covered. To keep the amount of special
cases small, ignore #MC.
- Debug Exception (#DB):
This takes the paranoid exit path only when the INT1 breakpoint is in
kernel space. #DB on a user space address takes the regular exit path,
so no extra mitigation required.
2. C-State transition 2. C-State transition
......
...@@ -270,9 +270,6 @@ config GENERIC_BUG ...@@ -270,9 +270,6 @@ config GENERIC_BUG
config GENERIC_BUG_RELATIVE_POINTERS config GENERIC_BUG_RELATIVE_POINTERS
bool bool
config GENERIC_HWEIGHT
def_bool y
config ARCH_MAY_HAVE_PC_FDC config ARCH_MAY_HAVE_PC_FDC
def_bool y def_bool y
depends on ISA_DMA_API depends on ISA_DMA_API
......
...@@ -73,14 +73,12 @@ const char *outfilename; ...@@ -73,14 +73,12 @@ const char *outfilename;
enum { enum {
sym_vvar_start, sym_vvar_start,
sym_vvar_page, sym_vvar_page,
sym_hpet_page,
sym_pvclock_page, sym_pvclock_page,
sym_hvclock_page, sym_hvclock_page,
}; };
const int special_pages[] = { const int special_pages[] = {
sym_vvar_page, sym_vvar_page,
sym_hpet_page,
sym_pvclock_page, sym_pvclock_page,
sym_hvclock_page, sym_hvclock_page,
}; };
...@@ -93,7 +91,6 @@ struct vdso_sym { ...@@ -93,7 +91,6 @@ struct vdso_sym {
struct vdso_sym required_syms[] = { struct vdso_sym required_syms[] = {
[sym_vvar_start] = {"vvar_start", true}, [sym_vvar_start] = {"vvar_start", true},
[sym_vvar_page] = {"vvar_page", true}, [sym_vvar_page] = {"vvar_page", true},
[sym_hpet_page] = {"hpet_page", true},
[sym_pvclock_page] = {"pvclock_page", true}, [sym_pvclock_page] = {"pvclock_page", true},
[sym_hvclock_page] = {"hvclock_page", true}, [sym_hvclock_page] = {"hvclock_page", true},
{"VDSO32_NOTE_MASK", true}, {"VDSO32_NOTE_MASK", true},
......
...@@ -12,8 +12,6 @@ ...@@ -12,8 +12,6 @@
#define REG_OUT "a" #define REG_OUT "a"
#endif #endif
#define __HAVE_ARCH_SW_HWEIGHT
static __always_inline unsigned int __arch_hweight32(unsigned int w) static __always_inline unsigned int __arch_hweight32(unsigned int w)
{ {
unsigned int res; unsigned int res;
......
...@@ -19,7 +19,6 @@ struct vdso_image { ...@@ -19,7 +19,6 @@ struct vdso_image {
long sym_vvar_start; /* Negative offset to the vvar area */ long sym_vvar_start; /* Negative offset to the vvar area */
long sym_vvar_page; long sym_vvar_page;
long sym_hpet_page;
long sym_pvclock_page; long sym_pvclock_page;
long sym_hvclock_page; long sym_hvclock_page;
long sym_VDSO32_NOTE_MASK; long sym_VDSO32_NOTE_MASK;
......
...@@ -768,7 +768,7 @@ static struct kprobe kretprobe_kprobe = { ...@@ -768,7 +768,7 @@ static struct kprobe kretprobe_kprobe = {
/* /*
* Called from kretprobe_trampoline * Called from kretprobe_trampoline
*/ */
static __used void *trampoline_handler(struct pt_regs *regs) __used __visible void *trampoline_handler(struct pt_regs *regs)
{ {
struct kprobe_ctlblk *kcb; struct kprobe_ctlblk *kcb;
struct kretprobe_instance *ri = NULL; struct kretprobe_instance *ri = NULL;
......
...@@ -58,7 +58,6 @@ ...@@ -58,7 +58,6 @@
#include <asm/alternative.h> #include <asm/alternative.h>
#include <asm/fpu/xstate.h> #include <asm/fpu/xstate.h>
#include <asm/trace/mpx.h> #include <asm/trace/mpx.h>
#include <asm/nospec-branch.h>
#include <asm/mpx.h> #include <asm/mpx.h>
#include <asm/vm86.h> #include <asm/vm86.h>
#include <asm/umip.h> #include <asm/umip.h>
...@@ -368,13 +367,6 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code) ...@@ -368,13 +367,6 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
regs->ip = (unsigned long)general_protection; regs->ip = (unsigned long)general_protection;
regs->sp = (unsigned long)&gpregs->orig_ax; regs->sp = (unsigned long)&gpregs->orig_ax;
/*
* This situation can be triggered by userspace via
* modify_ldt(2) and the return does not take the regular
* user space exit, so a CPU buffer clear is required when
* MDS mitigation is enabled.
*/
mds_user_clear_cpu_buffers();
return; return;
} }
#endif #endif
......
This diff is collapsed.
...@@ -301,7 +301,11 @@ static int __init early_set_memory_enc_dec(unsigned long vaddr, ...@@ -301,7 +301,11 @@ static int __init early_set_memory_enc_dec(unsigned long vaddr,
else else
split_page_size_mask = 1 << PG_LEVEL_2M; split_page_size_mask = 1 << PG_LEVEL_2M;
kernel_physical_mapping_init(__pa(vaddr & pmask), /*
* kernel_physical_mapping_change() does not flush the TLBs, so
* a TLB flush is required after we exit from the for loop.
*/
kernel_physical_mapping_change(__pa(vaddr & pmask),
__pa((vaddr_end & pmask) + psize), __pa((vaddr_end & pmask) + psize),
split_page_size_mask); split_page_size_mask);
} }
......
...@@ -13,6 +13,9 @@ void early_ioremap_page_table_range_init(void); ...@@ -13,6 +13,9 @@ void early_ioremap_page_table_range_init(void);
unsigned long kernel_physical_mapping_init(unsigned long start, unsigned long kernel_physical_mapping_init(unsigned long start,
unsigned long end, unsigned long end,
unsigned long page_size_mask); unsigned long page_size_mask);
unsigned long kernel_physical_mapping_change(unsigned long start,
unsigned long end,
unsigned long page_size_mask);
void zone_sizes_init(void); void zone_sizes_init(void);
extern int after_bootmem; extern int after_bootmem;
......
...@@ -10,7 +10,6 @@ ...@@ -10,7 +10,6 @@
* The Hamming Weight of a number is the total number of bits set in it. * The Hamming Weight of a number is the total number of bits set in it.
*/ */
#ifndef __HAVE_ARCH_SW_HWEIGHT
unsigned int __sw_hweight32(unsigned int w) unsigned int __sw_hweight32(unsigned int w)
{ {
#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER #ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
...@@ -27,7 +26,6 @@ unsigned int __sw_hweight32(unsigned int w) ...@@ -27,7 +26,6 @@ unsigned int __sw_hweight32(unsigned int w)
#endif #endif
} }
EXPORT_SYMBOL(__sw_hweight32); EXPORT_SYMBOL(__sw_hweight32);
#endif
unsigned int __sw_hweight16(unsigned int w) unsigned int __sw_hweight16(unsigned int w)
{ {
...@@ -46,7 +44,6 @@ unsigned int __sw_hweight8(unsigned int w) ...@@ -46,7 +44,6 @@ unsigned int __sw_hweight8(unsigned int w)
} }
EXPORT_SYMBOL(__sw_hweight8); EXPORT_SYMBOL(__sw_hweight8);
#ifndef __HAVE_ARCH_SW_HWEIGHT
unsigned long __sw_hweight64(__u64 w) unsigned long __sw_hweight64(__u64 w)
{ {
#if BITS_PER_LONG == 32 #if BITS_PER_LONG == 32
...@@ -69,4 +66,3 @@ unsigned long __sw_hweight64(__u64 w) ...@@ -69,4 +66,3 @@ unsigned long __sw_hweight64(__u64 w)
#endif #endif
} }
EXPORT_SYMBOL(__sw_hweight64); EXPORT_SYMBOL(__sw_hweight64);
#endif
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment