* [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro
[not found] <20160701001209.7DA24D1C@viggo.jf.intel.com>
@ 2016-07-01 0:12 ` Dave Hansen
2016-07-01 9:23 ` Borislav Petkov
0 siblings, 1 reply; 6+ messages in thread
From: Dave Hansen @ 2016-07-01 0:12 UTC (permalink / raw)
To: linux-kernel
Cc: x86, linux-mm, torvalds, akpm, bp, ak, mhocko, Dave Hansen,
dave.hansen, luto, stable
From: Dave Hansen <dave.hansen@linux.intel.com>
epufeatures.h currently defines X86_BUG(9) twice on 32-bit:
#define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */
...
#ifdef CONFIG_X86_32
#define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */
#endif
I think what happened was that this added the X86_BUG_ESPFIX, but
in an #ifdef below most of the bugs:
[58a5aac5] x86/entry/32: Introduce and use X86_BUG_ESPFIX instead of paravirt_enabled
Then this came along and added X86_BUG_NULL_SEG, but collided
with the earlier one that did the bug below the main block
defining all the X86_BUG()s.
[7a5d6704] x86/cpu: Probe the behavior of nulling out a segment at boot time
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Andy Lutomirski <luto@kernel.org>
Cc: stable@vger.kernel.org
---
b/arch/x86/include/asm/cpufeatures.h | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff -puN arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros arch/x86/include/asm/cpufeatures.h
--- a/arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros 2016-06-30 17:10:41.215185869 -0700
+++ b/arch/x86/include/asm/cpufeatures.h 2016-06-30 17:10:41.218186005 -0700
@@ -301,10 +301,6 @@
#define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */
#define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */
#define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */
-#define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */
-#define X86_BUG_SWAPGS_FENCE X86_BUG(10) /* SWAPGS without input dep on GS */
-
-
#ifdef CONFIG_X86_32
/*
* 64-bit kernels don't use X86_BUG_ESPFIX. Make the define conditional
@@ -312,5 +308,7 @@
*/
#define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */
#endif
+#define X86_BUG_NULL_SEG X86_BUG(10) /* Nulling a selector preserves the base */
+#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */
#endif /* _ASM_X86_CPUFEATURES_H */
_
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro
2016-07-01 0:12 ` [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro Dave Hansen
@ 2016-07-01 9:23 ` Borislav Petkov
2016-07-01 16:30 ` Andy Lutomirski
0 siblings, 1 reply; 6+ messages in thread
From: Borislav Petkov @ 2016-07-01 9:23 UTC (permalink / raw)
To: Dave Hansen
Cc: linux-kernel, x86, linux-mm, torvalds, akpm, ak, mhocko,
dave.hansen, luto, stable
On Thu, Jun 30, 2016 at 05:12:10PM -0700, Dave Hansen wrote:
>
> From: Dave Hansen <dave.hansen@linux.intel.com>
>
> epufeatures.h currently defines X86_BUG(9) twice on 32-bit:
>
> #define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */
> ...
> #ifdef CONFIG_X86_32
> #define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */
> #endif
>
> I think what happened was that this added the X86_BUG_ESPFIX, but
> in an #ifdef below most of the bugs:
>
> [58a5aac5] x86/entry/32: Introduce and use X86_BUG_ESPFIX instead of paravirt_enabled
>
> Then this came along and added X86_BUG_NULL_SEG, but collided
> with the earlier one that did the bug below the main block
> defining all the X86_BUG()s.
>
> [7a5d6704] x86/cpu: Probe the behavior of nulling out a segment at boot time
>
> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
> Acked-by: Andy Lutomirski <luto@kernel.org>
> Cc: stable@vger.kernel.org
> ---
>
> b/arch/x86/include/asm/cpufeatures.h | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff -puN arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros arch/x86/include/asm/cpufeatures.h
> --- a/arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros 2016-06-30 17:10:41.215185869 -0700
> +++ b/arch/x86/include/asm/cpufeatures.h 2016-06-30 17:10:41.218186005 -0700
> @@ -301,10 +301,6 @@
> #define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */
> #define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */
> #define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */
> -#define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */
> -#define X86_BUG_SWAPGS_FENCE X86_BUG(10) /* SWAPGS without input dep on GS */
> -
> -
> #ifdef CONFIG_X86_32
> /*
> * 64-bit kernels don't use X86_BUG_ESPFIX. Make the define conditional
So I'd remove the "#ifdef CONFIG_X86_32" ifdeffery too and make that bit
unconditional - so what, we have enough free bits. But I'd leave the
comment to still avoid the confusion :)
--
Regards/Gruss,
Boris.
ECO tip #101: Trim your mails when you reply.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro
2016-07-01 9:23 ` Borislav Petkov
@ 2016-07-01 16:30 ` Andy Lutomirski
2016-07-01 16:46 ` Borislav Petkov
0 siblings, 1 reply; 6+ messages in thread
From: Andy Lutomirski @ 2016-07-01 16:30 UTC (permalink / raw)
To: Borislav Petkov
Cc: Michal Hocko, linux-kernel@vger.kernel.org, stable, Andi Kleen,
linux-mm@kvack.org, Linus Torvalds, Andrew Morton, X86 ML,
Dave Hansen, Dave Hansen
On Jul 1, 2016 2:23 AM, "Borislav Petkov" <bp@alien8.de> wrote:
>
> On Thu, Jun 30, 2016 at 05:12:10PM -0700, Dave Hansen wrote:
> >
> > From: Dave Hansen <dave.hansen@linux.intel.com>
> >
> > epufeatures.h currently defines X86_BUG(9) twice on 32-bit:
> >
> > #define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */
> > ...
> > #ifdef CONFIG_X86_32
> > #define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */
> > #endif
> >
> > I think what happened was that this added the X86_BUG_ESPFIX, but
> > in an #ifdef below most of the bugs:
> >
> > [58a5aac5] x86/entry/32: Introduce and use X86_BUG_ESPFIX instead of paravirt_enabled
> >
> > Then this came along and added X86_BUG_NULL_SEG, but collided
> > with the earlier one that did the bug below the main block
> > defining all the X86_BUG()s.
> >
> > [7a5d6704] x86/cpu: Probe the behavior of nulling out a segment at boot time
> >
> > Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
> > Acked-by: Andy Lutomirski <luto@kernel.org>
> > Cc: stable@vger.kernel.org
> > ---
> >
> > b/arch/x86/include/asm/cpufeatures.h | 6 ++----
> > 1 file changed, 2 insertions(+), 4 deletions(-)
> >
> > diff -puN arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros arch/x86/include/asm/cpufeatures.h
> > --- a/arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros 2016-06-30 17:10:41.215185869 -0700
> > +++ b/arch/x86/include/asm/cpufeatures.h 2016-06-30 17:10:41.218186005 -0700
> > @@ -301,10 +301,6 @@
> > #define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */
> > #define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */
> > #define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */
> > -#define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */
> > -#define X86_BUG_SWAPGS_FENCE X86_BUG(10) /* SWAPGS without input dep on GS */
> > -
> > -
> > #ifdef CONFIG_X86_32
> > /*
> > * 64-bit kernels don't use X86_BUG_ESPFIX. Make the define conditional
>
> So I'd remove the "#ifdef CONFIG_X86_32" ifdeffery too and make that bit
> unconditional - so what, we have enough free bits. But I'd leave the
> comment to still avoid the confusion :)
>
I put the ifdef there to prevent anyone from accidentally using it in
a 64-bit code path, not to save a bit. We could put in the middle of
the list to make the mistake much less likely to be repeated, I
suppose.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro
2016-07-01 16:30 ` Andy Lutomirski
@ 2016-07-01 16:46 ` Borislav Petkov
2016-07-03 14:36 ` Andy Lutomirski
0 siblings, 1 reply; 6+ messages in thread
From: Borislav Petkov @ 2016-07-01 16:46 UTC (permalink / raw)
To: Andy Lutomirski
Cc: Michal Hocko, linux-kernel@vger.kernel.org, stable, Andi Kleen,
linux-mm@kvack.org, Linus Torvalds, Andrew Morton, X86 ML,
Dave Hansen, Dave Hansen
On Fri, Jul 01, 2016 at 09:30:37AM -0700, Andy Lutomirski wrote:
> I put the ifdef there to prevent anyone from accidentally using it in
> a 64-bit code path, not to save a bit. We could put in the middle of
> the list to make the mistake much less likely to be repeated, I
> suppose.
Well, if someone does, someone will notice pretty soon, no?
I just don't see the reason to worry but maybe I'm missing it.
And we can call it X86_BUG_ESPFIX_X86_32 or so too...
--
Regards/Gruss,
Boris.
ECO tip #101: Trim your mails when you reply.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro
2016-07-01 16:46 ` Borislav Petkov
@ 2016-07-03 14:36 ` Andy Lutomirski
2016-07-03 18:44 ` Borislav Petkov
0 siblings, 1 reply; 6+ messages in thread
From: Andy Lutomirski @ 2016-07-03 14:36 UTC (permalink / raw)
To: Borislav Petkov
Cc: Dave Hansen, Michal Hocko, X86 ML, linux-mm@kvack.org, stable,
Andrew Morton, linux-kernel@vger.kernel.org, Dave Hansen,
Linus Torvalds, Andi Kleen
On Jul 1, 2016 9:47 AM, "Borislav Petkov" <bp@alien8.de> wrote:
>
> On Fri, Jul 01, 2016 at 09:30:37AM -0700, Andy Lutomirski wrote:
> > I put the ifdef there to prevent anyone from accidentally using it in
> > a 64-bit code path, not to save a bit. We could put in the middle of
> > the list to make the mistake much less likely to be repeated, I
> > suppose.
>
> Well, if someone does, someone will notice pretty soon, no?
Dunno. ESPFIX was broken under KVM for years and no one notices.
>
> I just don't see the reason to worry but maybe I'm missing it.
>
> And we can call it X86_BUG_ESPFIX_X86_32 or so too...
We could do that, too, I guess. But the current solution is only two
extra lines of code. We could reorder the things so that it's in the
middle instead of at the end, I suppose.
--Andy
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro
2016-07-03 14:36 ` Andy Lutomirski
@ 2016-07-03 18:44 ` Borislav Petkov
0 siblings, 0 replies; 6+ messages in thread
From: Borislav Petkov @ 2016-07-03 18:44 UTC (permalink / raw)
To: Andy Lutomirski
Cc: Dave Hansen, Michal Hocko, X86 ML, linux-mm@kvack.org, stable,
Andrew Morton, linux-kernel@vger.kernel.org, Dave Hansen,
Linus Torvalds, Andi Kleen
On Sun, Jul 03, 2016 at 07:36:30AM -0700, Andy Lutomirski wrote:
> Dunno. ESPFIX was broken under KVM for years and no one notices.
Ah, so this really was the case already. :-\
> We could do that, too, I guess. But the current solution is only two
> extra lines of code. We could reorder the things so that it's in the
> middle instead of at the end, I suppose.
Yeah, sounds good. Especially if it was already broken - I missed that
fact.
Thanks.
--
Regards/Gruss,
Boris.
ECO tip #101: Trim your mails when you reply.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-07-03 18:44 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20160701001209.7DA24D1C@viggo.jf.intel.com>
2016-07-01 0:12 ` [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro Dave Hansen
2016-07-01 9:23 ` Borislav Petkov
2016-07-01 16:30 ` Andy Lutomirski
2016-07-01 16:46 ` Borislav Petkov
2016-07-03 14:36 ` Andy Lutomirski
2016-07-03 18:44 ` Borislav Petkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).