linux-stable.git/arch/x86/kernel/fpu, branch linux-4.8.y

x86/fpu: Fix invalid FPU ptrace state after execve()

2016-12-02T08:10:31+00:00

commit b22cbe404a9cc3c7949e380fa1861e31934c8978 upstream.

Robert O'Callahan reported that after an execve PTRACE_GETREGSET
NT_X86_XSTATE continues to return the pre-exec register values
until the exec'ed task modifies FPU state.

The test code is at:

  https://bugzilla.redhat.com/attachment.cgi?id=1164286.

What is happening is fpu__clear() does not properly clear fpstate.
Fix it by doing just that.

Reported-by: Robert O'Callahan 
Signed-off-by: Yu-cheng Yu 
Cc: Andy Lutomirski 
Cc: Borislav Petkov 
Cc: David Hansen 
Cc: Fenghua Yu 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Ravi V. Shankar 
Cc: Thomas Gleixner 
Link: http://lkml.kernel.org/r/1479402695-6553-1-git-send-email-yu-cheng.yu@intel.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman

x86/mm/pkeys: Fix compact mode by removing protection keys' XSAVE buffer manipulation

2016-08-10T14:12:26+00:00

The Memory Protection Keys "rights register" (PKRU) is
XSAVE-managed, and is saved/restored along with the FPU state.

When kernel code accesses FPU regsisters, it does a delicate
dance with preempt.  Otherwise, the context switching code can
get confused as to whether the most up-to-date state is in the
registers themselves or in the XSAVE buffer.

But, PKRU is not a normal FPU register.  Using it does not
generate the normal device-not-available (#NM) exceptions which
means we can not manage it lazily, and the kernel completley
disallows using lazy mode when it is enabled.

The dance with preempt *only* occurs when managing the FPU
lazily.  Since we never manage PKRU lazily, we do not have to do
the dance with preempt; we can access it directly.  Doing it
this way saves a ton of complicated code (and is faster too).

Further, the XSAVES reenabling failed to patch a bit of code
in fpu__xfeature_set_state() the checked for compacted buffers.
That check caused fpu__xfeature_set_state() to silently refuse to
work when the kernel is using compacted XSAVE buffers.  This
broke execute-only and future pkey_mprotect() support when using
compact XSAVE buffers.

But, removing fpu__xfeature_set_state() gets rid of this issue,
in addition to the nice cleanup and speedup.

This fixes the same thing as a fix that Sai posted:

  https://lkml.org/lkml/2016/7/25/637

The fix that he posted is a much more obviously correct, but I
think we should just do this instead.

Reported-by: Sai Praneeth Prakhya 
Signed-off-by: Dave Hansen 
Cc: Andy Lutomirski 
Cc: Borislav Petkov 
Cc: Dave Hansen 
Cc: Dave Hansen 
Cc: Fenghua Yu 
Cc: H. Peter Anvin 
Cc: Linus Torvalds 
Cc: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Quentin Casasnovas 
Cc: Ravi Shankar 
Cc: Thomas Gleixner 
Cc: Yu-Cheng Yu 
Link: http://lkml.kernel.org/r/20160727232040.7D060DAD@viggo.jf.intel.com
Signed-off-by: Ingo Molnar

tree-wide: replace config_enabled() with IS_ENABLED()

2016-08-04T12:50:07+00:00

The use of config_enabled() against config options is ambiguous.  In
practical terms, config_enabled() is equivalent to IS_BUILTIN(), but the
author might have used it for the meaning of IS_ENABLED().  Using
IS_ENABLED(), IS_BUILTIN(), IS_MODULE() etc.  makes the intention
clearer.

This commit replaces config_enabled() with IS_ENABLED() where possible.
This commit is only touching bool config options.

I noticed two cases where config_enabled() is used against a tristate
option:

 - config_enabled(CONFIG_HWMON)
  [ drivers/net/wireless/ath/ath10k/thermal.c ]

 - config_enabled(CONFIG_BACKLIGHT_CLASS_DEVICE)
  [ drivers/gpu/drm/gma500/opregion.c ]

I did not touch them because they should be converted to IS_BUILTIN()
in order to keep the logic, but I was not sure it was the authors'
intention.

Link: http://lkml.kernel.org/r/1465215656-20569-1-git-send-email-yamada.masahiro@socionext.com
Signed-off-by: Masahiro Yamada 
Acked-by: Kees Cook 
Cc: Stas Sergeev 
Cc: Matt Redfearn 
Cc: Joshua Kinard 
Cc: Jiri Slaby 
Cc: Bjorn Helgaas 
Cc: Borislav Petkov 
Cc: Markos Chandras 
Cc: "Dmitry V. Levin" 
Cc: yu-cheng yu 
Cc: James Hogan 
Cc: Brian Gerst 
Cc: Johannes Berg 
Cc: Peter Zijlstra 
Cc: Al Viro 
Cc: Will Drewry 
Cc: Nikolay Martynov 
Cc: Huacai Chen 
Cc: "H. Peter Anvin" 
Cc: Thomas Gleixner 
Cc: Daniel Borkmann 
Cc: Leonid Yegoshin 
Cc: Rafal Milecki 
Cc: James Cowgill 
Cc: Greg Kroah-Hartman 
Cc: Ralf Baechle 
Cc: Alex Smith 
Cc: Adam Buchbinder 
Cc: Qais Yousef 
Cc: Jiang Liu 
Cc: Mikko Rapeli 
Cc: Paul Gortmaker 
Cc: Denys Vlasenko 
Cc: Brian Norris 
Cc: Hidehiro Kawai 
Cc: "Luis R. Rodriguez" 
Cc: Andy Lutomirski 
Cc: Ingo Molnar 
Cc: Dave Hansen 
Cc: "Kirill A. Shutemov" 
Cc: Roland McGrath 
Cc: Paul Burton 
Cc: Kalle Valo 
Cc: Viresh Kumar 
Cc: Tony Wu 
Cc: Huaitong Han 
Cc: Sumit Semwal 
Cc: Alexei Starovoitov 
Cc: Juergen Gross 
Cc: Jason Cooper 
Cc: "David S. Miller" 
Cc: Oleg Nesterov 
Cc: Andrea Gelmini 
Cc: David Woodhouse 
Cc: Marc Zyngier 
Cc: Rabin Vincent 
Cc: "Maciej W. Rozycki" 
Cc: David Daney 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

x86/fpu: Do not BUG_ON() in early FPU code

2016-07-21T16:18:45+00:00

I don't think it is really possible to have a system where CPUID
enumerates support for XSAVE but that it does not have FP/SSE
(they are "legacy" features and always present).

But, I did manage to hit this case in qemu when I enabled its
somewhat shaky XSAVE support.  The bummer is that the FPU is set
up before we parse the command-line or have *any* console support
including earlyprintk.  That turned what should have been an easy
thing to debug in to a bit more of an odyssey.

So a BUG() here is worthless.  All it does it guarantee that
if/when we hit this case we have an empty console.  So, remove
the BUG() and try to limp along by disabling XSAVE and trying to
continue.  Add a comment on why we are doing this, and also add
a common "out_disable" path for leaving fpu__init_system_xstate().

Signed-off-by: Dave Hansen 
Cc: Andy Lutomirski 
Cc: Borislav Petkov 
Cc: Brian Gerst 
Cc: Dave Hansen 
Cc: Denys Vlasenko 
Cc: Fenghua Yu 
Cc: H. Peter Anvin 
Cc: Josh Poimboeuf 
Cc: Linus Torvalds 
Cc: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Quentin Casasnovas 
Cc: Thomas Gleixner 
Link: http://lkml.kernel.org/r/20160720194551.63BB2B58@viggo.jf.intel.com
Signed-off-by: Ingo Molnar

x86/fpu/xstate: Re-enable XSAVES

2016-07-11T14:44:01+00:00

We did not handle XSAVES instructions correctly. There were issues in
converting between standard and compacted format when interfacing with
user-space. These issues have been corrected.

Add a WARN_ONCE() to make it clear that XSAVES supervisor states are not
yet implemented.

Signed-off-by: Yu-cheng Yu 
Signed-off-by: Fenghua Yu 
Reviewed-by: Dave Hansen 
Cc: H. Peter Anvin 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Ravi V Shankar 
Cc: Thomas Gleixner 
Link: http://lkml.kernel.org/r/1468253937-40008-5-git-send-email-fenghua.yu@intel.com
Signed-off-by: Ingo Molnar

x86/fpu/xstate: Fix fpstate_init() for XRSTORS

2016-07-11T14:44:00+00:00

In XSAVES mode if fpstate_init() is used to initialize a
task's extended state area, xsave.header.xcomp_bv[63] must
be set. Otherwise, when the task is scheduled, a warning is
triggered from copy_kernel_to_xregs().

One such test case is: setting an invalid extended state
through PTRACE. When xstateregs_set() rejects the syscall
and re-initializes the task's extended state area. This triggers
the warning mentioned above.

Signed-off-by: Yu-cheng Yu 
Signed-off-by: Fenghua Yu 
Reviewed-by: Dave Hansen 
Cc: H. Peter Anvin 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Ravi V Shankar 
Cc: Thomas Gleixner 
Link: http://lkml.kernel.org/r/1468253937-40008-4-git-send-email-fenghua.yu@intel.com
Signed-off-by: Ingo Molnar

x86/fpu/xstate: Return NULL for disabled xstate component address

2016-07-11T14:44:00+00:00

It is an error to request a disabled XSAVE/XSAVES component address.
For that case, make __raw_xsave_addr() return a NULL and issue a
warning.

Signed-off-by: Yu-cheng Yu 
Signed-off-by: Fenghua Yu 
Reviewed-by: Dave Hansen 
Cc: H. Peter Anvin 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Ravi V Shankar 
Cc: Thomas Gleixner 
Link: http://lkml.kernel.org/r/1468253937-40008-3-git-send-email-fenghua.yu@intel.com
Signed-off-by: Ingo Molnar

x86/fpu/xstate: Fix __fpu_restore_sig() for XSAVES

2016-07-11T14:43:59+00:00

When the kernel is using XSAVES compacted format, we cannot do
__copy_from_user() from a signal frame, which has standard-format data.
Fix it by using copyin_to_xsaves(), which converts between formats and
filters out all supervisor states that we do not allow userspace to
write.

Signed-off-by: Yu-cheng Yu 
Signed-off-by: Fenghua Yu 
Reviewed-by: Dave Hansen 
Cc: H. Peter Anvin 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Ravi V Shankar 
Cc: Thomas Gleixner 
Link: http://lkml.kernel.org/r/1468253937-40008-2-git-send-email-fenghua.yu@intel.com
Signed-off-by: Ingo Molnar

x86/fpu/xstate: Fix xstate_offsets, xstate_sizes for non-extended xstates

2016-07-10T15:12:11+00:00

The arrays xstate_offsets[] and xstate_sizes[] record XSAVE standard-
format offsets and sizes. Values for non-extended state components
fpu and xmm's were not initialized or used. Ptrace format conversion
needs them. Fix it.

Signed-off-by: Yu-cheng Yu 
Reviewed-by: Dave Hansen 
Cc: Andy Lutomirski 
Cc: Borislav Petkov 
Cc: Brian Gerst 
Cc: Dave Hansen 
Cc: Denys Vlasenko 
Cc: Fenghua Yu 
Cc: H. Peter Anvin 
Cc: Josh Poimboeuf 
Cc: Linus Torvalds 
Cc: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Quentin Casasnovas 
Cc: Ravi V. Shankar 
Cc: Sai Praneeth Prakhya 
Cc: Thomas Gleixner 
Link: http://lkml.kernel.org/r/cf3ea36cf30e2a99e37da6483e65446d018ff0a7.1466179491.git.yu-cheng.yu@intel.com
Signed-off-by: Ingo Molnar

x86/fpu/xstate: Fix XSTATE component offset print out

2016-07-10T15:12:10+00:00

Component offset print out was incorrect for XSAVES. Correct it and move
to a separate function.

Signed-off-by: Yu-cheng Yu 
Reviewed-by: Dave Hansen 
Cc: Andy Lutomirski 
Cc: Borislav Petkov 
Cc: Brian Gerst 
Cc: Dave Hansen 
Cc: Denys Vlasenko 
Cc: Fenghua Yu 
Cc: H. Peter Anvin 
Cc: Josh Poimboeuf 
Cc: Linus Torvalds 
Cc: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Quentin Casasnovas 
Cc: Ravi V. Shankar 
Cc: Sai Praneeth Prakhya 
Cc: Thomas Gleixner 
Link: http://lkml.kernel.org/r/86602a8ac400626c6eca7125c3e15934866fc38e.1466179491.git.yu-cheng.yu@intel.com
Signed-off-by: Ingo Molnar