Commit f5d54a42 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'x86_urgent_for_v5.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull x86 fixes from Borislav Petkov:

 - Fix a couple of SWAPGS fencing issues in the x86 entry code

 - Use the proper operand types in __{get,put}_user() to prevent
   truncation in SEV-ES string io

 - Make sure the kernel mappings are present in trampoline_pgd in order
   to prevent any potential accesses to unmapped memory after switching
   to it

 - Fix a trivial list corruption in objtool's pv_ops validation

 - Disable the clocksource watchdog for TSC on platforms which claim
   that the TSC is constant, doesn't stop in sleep states, CPU has TSC
   adjust and the number of sockets of the platform are max 2, to
   prevent erroneous markings of the TSC as unstable.

 - Make sure TSC adjust is always checked not only when going idle

 - Prevent a stack leak by initializing struct _fpx_sw_bytes properly in
   the FPU code

 - Fix INTEL_FAM6_RAPTORLAKE define naming to adhere to the convention

* tag 'x86_urgent_for_v5.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/xen: Add xenpv_restore_regs_and_return_to_usermode()
  x86/entry: Use the correct fence macro after swapgs in kernel CR3
  x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
  x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
  x86/64/mm: Map all kernel memory into trampoline_pgd
  objtool: Fix pv_ops noinstr validation
  x86/tsc: Disable clocksource watchdog for TSC on qualified platorms
  x86/tsc: Add a timer to make sure TSC_adjust is always checked
  x86/fpu/signal: Initialize sw_bytes in save_xstate_epilog()
  x86/cpu: Drop spurious underscore from RAPTOR_LAKE #define
parents 90bf8d98 5c8f6a2e

arch/x86/entry/entry_64.S

+17 −18
Original line number Diff line number Diff line
@@ -574,6 +574,10 @@ SYM_INNER_LABEL(swapgs_restore_regs_and_return_to_usermode, SYM_L_GLOBAL) 
	ud2

1:

#endif

#ifdef CONFIG_XEN_PV

	ALTERNATIVE "", "jmp xenpv_restore_regs_and_return_to_usermode", X86_FEATURE_XENPV

#endif



	POP_REGS pop_rdi=0



	/*
@@ -890,6 +894,7 @@ SYM_CODE_START_LOCAL(paranoid_entry) 
.Lparanoid_entry_checkgs:

	/* EBX = 1 -> kernel GSBASE active, no restore required */

	movl	$1, %ebx



	/*

	 * The kernel-enforced convention is a negative GSBASE indicates

	 * a kernel value. No SWAPGS needed on entry and exit.
@@ -897,21 +902,14 @@ SYM_CODE_START_LOCAL(paranoid_entry) 
	movl	$MSR_GS_BASE, %ecx

	rdmsr

	testl	%edx, %edx

	jns	.Lparanoid_entry_swapgs

	ret

	js	.Lparanoid_kernel_gsbase



.Lparanoid_entry_swapgs:

	/* EBX = 0 -> SWAPGS required on exit */

	xorl	%ebx, %ebx

	swapgs

.Lparanoid_kernel_gsbase:



	/*

	 * The above SAVE_AND_SWITCH_TO_KERNEL_CR3 macro doesn't do an

	 * unconditional CR3 write, even in the PTI case.  So do an lfence

	 * to prevent GS speculation, regardless of whether PTI is enabled.

	 */

	FENCE_SWAPGS_KERNEL_ENTRY



	/* EBX = 0 -> SWAPGS required on exit */

	xorl	%ebx, %ebx

	ret

SYM_CODE_END(paranoid_entry)
@@ -993,11 +991,6 @@ SYM_CODE_START_LOCAL(error_entry) 
	pushq	%r12

	ret



.Lerror_entry_done_lfence:

	FENCE_SWAPGS_KERNEL_ENTRY

.Lerror_entry_done:

	ret



	/*

	 * There are two places in the kernel that can potentially fault with

	 * usergs. Handle them here.  B stepping K8s sometimes report a
@@ -1020,8 +1013,14 @@ SYM_CODE_START_LOCAL(error_entry) 
	 * .Lgs_change's error handler with kernel gsbase.

	 */

	SWAPGS

	FENCE_SWAPGS_USER_ENTRY

	jmp .Lerror_entry_done



	/*

	 * Issue an LFENCE to prevent GS speculation, regardless of whether it is a

	 * kernel or user gsbase.

	 */

.Lerror_entry_done_lfence:

	FENCE_SWAPGS_KERNEL_ENTRY

	ret



.Lbstep_iret:

	/* Fix truncated RIP */

arch/x86/include/asm/intel-family.h

+1 −1
Original line number Diff line number Diff line
@@ -108,7 +108,7 @@ 
#define INTEL_FAM6_ALDERLAKE		0x97	/* Golden Cove / Gracemont */

#define INTEL_FAM6_ALDERLAKE_L		0x9A	/* Golden Cove / Gracemont */



#define INTEL_FAM6_RAPTOR_LAKE		0xB7

#define INTEL_FAM6_RAPTORLAKE		0xB7



/* "Small Core" Processors (Atom) */

arch/x86/kernel/fpu/signal.c

+1 −1
Original line number Diff line number Diff line
@@ -118,7 +118,7 @@ static inline bool save_xstate_epilog(void __user *buf, int ia32_frame, 
				      struct fpstate *fpstate)

{

	struct xregs_state __user *x = buf;

	struct _fpx_sw_bytes sw_bytes;

	struct _fpx_sw_bytes sw_bytes = {};

	u32 xfeatures;

	int err;

arch/x86/kernel/sev.c

+39 −18
Original line number Diff line number Diff line
@@ -294,11 +294,6 @@ static enum es_result vc_write_mem(struct es_em_ctxt *ctxt, 
				   char *dst, char *buf, size_t size)

{

	unsigned long error_code = X86_PF_PROT | X86_PF_WRITE;

	char __user *target = (char __user *)dst;

	u64 d8;

	u32 d4;

	u16 d2;

	u8  d1;



	/*

	 * This function uses __put_user() independent of whether kernel or user
@@ -320,26 +315,42 @@ static enum es_result vc_write_mem(struct es_em_ctxt *ctxt, 
	 * instructions here would cause infinite nesting.

	 */

	switch (size) {

	case 1:

	case 1: {

		u8 d1;

		u8 __user *target = (u8 __user *)dst;



		memcpy(&d1, buf, 1);

		if (__put_user(d1, target))

			goto fault;

		break;

	case 2:

	}

	case 2: {

		u16 d2;

		u16 __user *target = (u16 __user *)dst;



		memcpy(&d2, buf, 2);

		if (__put_user(d2, target))

			goto fault;

		break;

	case 4:

	}

	case 4: {

		u32 d4;

		u32 __user *target = (u32 __user *)dst;



		memcpy(&d4, buf, 4);

		if (__put_user(d4, target))

			goto fault;

		break;

	case 8:

	}

	case 8: {

		u64 d8;

		u64 __user *target = (u64 __user *)dst;



		memcpy(&d8, buf, 8);

		if (__put_user(d8, target))

			goto fault;

		break;

	}

	default:

		WARN_ONCE(1, "%s: Invalid size: %zu\n", __func__, size);

		return ES_UNSUPPORTED;
@@ -362,11 +373,6 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt, 
				  char *src, char *buf, size_t size)

{

	unsigned long error_code = X86_PF_PROT;

	char __user *s = (char __user *)src;

	u64 d8;

	u32 d4;

	u16 d2;

	u8  d1;



	/*

	 * This function uses __get_user() independent of whether kernel or user
@@ -388,26 +394,41 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt, 
	 * instructions here would cause infinite nesting.

	 */

	switch (size) {

	case 1:

	case 1: {

		u8 d1;

		u8 __user *s = (u8 __user *)src;



		if (__get_user(d1, s))

			goto fault;

		memcpy(buf, &d1, 1);

		break;

	case 2:

	}

	case 2: {

		u16 d2;

		u16 __user *s = (u16 __user *)src;



		if (__get_user(d2, s))

			goto fault;

		memcpy(buf, &d2, 2);

		break;

	case 4:

	}

	case 4: {

		u32 d4;

		u32 __user *s = (u32 __user *)src;



		if (__get_user(d4, s))

			goto fault;

		memcpy(buf, &d4, 4);

		break;

	case 8:

	}

	case 8: {

		u64 d8;

		u64 __user *s = (u64 __user *)src;

		if (__get_user(d8, s))

			goto fault;

		memcpy(buf, &d8, 8);

		break;

	}

	default:

		WARN_ONCE(1, "%s: Invalid size: %zu\n", __func__, size);

		return ES_UNSUPPORTED;

arch/x86/kernel/tsc.c

+24 −4
Original line number Diff line number Diff line
@@ -1180,6 +1180,12 @@ void mark_tsc_unstable(char *reason) 


EXPORT_SYMBOL_GPL(mark_tsc_unstable);



static void __init tsc_disable_clocksource_watchdog(void)

{

	clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY;

	clocksource_tsc.flags &= ~CLOCK_SOURCE_MUST_VERIFY;

}



static void __init check_system_tsc_reliable(void)

{

#if defined(CONFIG_MGEODEGX1) || defined(CONFIG_MGEODE_LX) || defined(CONFIG_X86_GENERIC)
@@ -1196,6 +1202,23 @@ static void __init check_system_tsc_reliable(void) 
#endif

	if (boot_cpu_has(X86_FEATURE_TSC_RELIABLE))

		tsc_clocksource_reliable = 1;



	/*

	 * Disable the clocksource watchdog when the system has:

	 *  - TSC running at constant frequency

	 *  - TSC which does not stop in C-States

	 *  - the TSC_ADJUST register which allows to detect even minimal

	 *    modifications

	 *  - not more than two sockets. As the number of sockets cannot be

	 *    evaluated at the early boot stage where this has to be

	 *    invoked, check the number of online memory nodes as a

	 *    fallback solution which is an reasonable estimate.

	 */

	if (boot_cpu_has(X86_FEATURE_CONSTANT_TSC) &&

	    boot_cpu_has(X86_FEATURE_NONSTOP_TSC) &&

	    boot_cpu_has(X86_FEATURE_TSC_ADJUST) &&

	    nr_online_nodes <= 2)

		tsc_disable_clocksource_watchdog();

}



/*
@@ -1387,9 +1410,6 @@ static int __init init_tsc_clocksource(void) 
	if (tsc_unstable)

		goto unreg;



	if (tsc_clocksource_reliable || no_tsc_watchdog)

		clocksource_tsc.flags &= ~CLOCK_SOURCE_MUST_VERIFY;



	if (boot_cpu_has(X86_FEATURE_NONSTOP_TSC_S3))

		clocksource_tsc.flags |= CLOCK_SOURCE_SUSPEND_NONSTOP;
@@ -1527,7 +1547,7 @@ void __init tsc_init(void) 
	}



	if (tsc_clocksource_reliable || no_tsc_watchdog)

		clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY;

		tsc_disable_clocksource_watchdog();



	clocksource_register_khz(&clocksource_tsc_early, tsc_khz);

	detect_art();