From: Greg Kroah-Hartman Date: Thu, 1 Sep 2022 10:23:15 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.9.327~54 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f349e4e5e8c9d14bfeac4441adea358bcc4aa8d8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: kbuild-fix-include-path-in-scripts-makefile.modpost.patch s390-mm-do-not-trigger-write-fault-when-vma-does-not-allow-vm_write.patch x86-bugs-add-unknown-reporting-for-mmio-stale-data.patch --- diff --git a/queue-5.4/kbuild-fix-include-path-in-scripts-makefile.modpost.patch b/queue-5.4/kbuild-fix-include-path-in-scripts-makefile.modpost.patch new file mode 100644 index 00000000000..088bea0ef28 --- /dev/null +++ b/queue-5.4/kbuild-fix-include-path-in-scripts-makefile.modpost.patch @@ -0,0 +1,44 @@ +From 23a0cb8e3225122496bfa79172005c587c2d64bf Mon Sep 17 00:00:00 2001 +From: Jing Leng +Date: Tue, 17 May 2022 18:51:28 +0800 +Subject: kbuild: Fix include path in scripts/Makefile.modpost + +From: Jing Leng + +commit 23a0cb8e3225122496bfa79172005c587c2d64bf upstream. + +When building an external module, if users don't need to separate the +compilation output and source code, they run the following command: +"make -C $(LINUX_SRC_DIR) M=$(PWD)". At this point, "$(KBUILD_EXTMOD)" +and "$(src)" are the same. + +If they need to separate them, they run "make -C $(KERNEL_SRC_DIR) +O=$(KERNEL_OUT_DIR) M=$(OUT_DIR) src=$(PWD)". Before running the +command, they need to copy "Kbuild" or "Makefile" to "$(OUT_DIR)" to +prevent compilation failure. + +So the kernel should change the included path to avoid the copy operation. + +Signed-off-by: Jing Leng +[masahiro: I do not think "M=$(OUT_DIR) src=$(PWD)" is the official way, +but this patch is a nice clean up anyway.] +Signed-off-by: Masahiro Yamada +[nsc: updated context for v4.19] +Signed-off-by: Nicolas Schier +Signed-off-by: Greg Kroah-Hartman +--- + scripts/Makefile.modpost | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/scripts/Makefile.modpost ++++ b/scripts/Makefile.modpost +@@ -75,8 +75,7 @@ obj := $(KBUILD_EXTMOD) + src := $(obj) + + # Include the module's Makefile to find KBUILD_EXTRA_SYMBOLS +-include $(if $(wildcard $(KBUILD_EXTMOD)/Kbuild), \ +- $(KBUILD_EXTMOD)/Kbuild, $(KBUILD_EXTMOD)/Makefile) ++include $(if $(wildcard $(src)/Kbuild), $(src)/Kbuild, $(src)/Makefile) + endif + + MODPOST += $(subst -i,-n,$(filter -i,$(MAKEFLAGS))) -s -T - $(wildcard vmlinux) diff --git a/queue-5.4/s390-mm-do-not-trigger-write-fault-when-vma-does-not-allow-vm_write.patch b/queue-5.4/s390-mm-do-not-trigger-write-fault-when-vma-does-not-allow-vm_write.patch new file mode 100644 index 00000000000..f387e276af0 --- /dev/null +++ b/queue-5.4/s390-mm-do-not-trigger-write-fault-when-vma-does-not-allow-vm_write.patch @@ -0,0 +1,50 @@ +From 41ac42f137080bc230b5882e3c88c392ab7f2d32 Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Wed, 17 Aug 2022 15:26:03 +0200 +Subject: s390/mm: do not trigger write fault when vma does not allow VM_WRITE + +From: Gerald Schaefer + +commit 41ac42f137080bc230b5882e3c88c392ab7f2d32 upstream. + +For non-protection pXd_none() page faults in do_dat_exception(), we +call do_exception() with access == (VM_READ | VM_WRITE | VM_EXEC). +In do_exception(), vma->vm_flags is checked against that before +calling handle_mm_fault(). + +Since commit 92f842eac7ee3 ("[S390] store indication fault optimization"), +we call handle_mm_fault() with FAULT_FLAG_WRITE, when recognizing that +it was a write access. However, the vma flags check is still only +checking against (VM_READ | VM_WRITE | VM_EXEC), and therefore also +calling handle_mm_fault() with FAULT_FLAG_WRITE in cases where the vma +does not allow VM_WRITE. + +Fix this by changing access check in do_exception() to VM_WRITE only, +when recognizing write access. + +Link: https://lkml.kernel.org/r/20220811103435.188481-3-david@redhat.com +Fixes: 92f842eac7ee3 ("[S390] store indication fault optimization") +Cc: +Reported-by: David Hildenbrand +Reviewed-by: Heiko Carstens +Signed-off-by: Gerald Schaefer +Signed-off-by: Vasily Gorbik +Signed-off-by: Gerald Schaefer +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/fault.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/s390/mm/fault.c ++++ b/arch/s390/mm/fault.c +@@ -432,7 +432,9 @@ static inline vm_fault_t do_exception(st + flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; + if (user_mode(regs)) + flags |= FAULT_FLAG_USER; +- if (access == VM_WRITE || (trans_exc_code & store_indication) == 0x400) ++ if ((trans_exc_code & store_indication) == 0x400) ++ access = VM_WRITE; ++ if (access == VM_WRITE) + flags |= FAULT_FLAG_WRITE; + down_read(&mm->mmap_sem); + diff --git a/queue-5.4/series b/queue-5.4/series index 125922b076e..30fe311b286 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -47,3 +47,6 @@ md-call-__md_stop_writes-in-md_stop.patch perf-x86-intel-uncore-fix-broken-read_counter-for-snb-imc-pmu.patch scsi-storvsc-remove-wq_mem_reclaim-from-storvsc_error_wq.patch mm-force-tlb-flush-for-pfnmap-mappings-before-unlink_file_vma.patch +s390-mm-do-not-trigger-write-fault-when-vma-does-not-allow-vm_write.patch +x86-bugs-add-unknown-reporting-for-mmio-stale-data.patch +kbuild-fix-include-path-in-scripts-makefile.modpost.patch diff --git a/queue-5.4/x86-bugs-add-unknown-reporting-for-mmio-stale-data.patch b/queue-5.4/x86-bugs-add-unknown-reporting-for-mmio-stale-data.patch new file mode 100644 index 00000000000..e82e69e31e4 --- /dev/null +++ b/queue-5.4/x86-bugs-add-unknown-reporting-for-mmio-stale-data.patch @@ -0,0 +1,204 @@ +From 7df548840c496b0141fb2404b889c346380c2b22 Mon Sep 17 00:00:00 2001 +From: Pawan Gupta +Date: Wed, 3 Aug 2022 14:41:32 -0700 +Subject: x86/bugs: Add "unknown" reporting for MMIO Stale Data + +From: Pawan Gupta + +commit 7df548840c496b0141fb2404b889c346380c2b22 upstream. + +Older Intel CPUs that are not in the affected processor list for MMIO +Stale Data vulnerabilities currently report "Not affected" in sysfs, +which may not be correct. Vulnerability status for these older CPUs is +unknown. + +Add known-not-affected CPUs to the whitelist. Report "unknown" +mitigation status for CPUs that are not in blacklist, whitelist and also +don't enumerate MSR ARCH_CAPABILITIES bits that reflect hardware +immunity to MMIO Stale Data vulnerabilities. + +Mitigation is not deployed when the status is unknown. + + [ bp: Massage, fixup. ] + +Fixes: 8d50cdf8b834 ("x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data") +Suggested-by: Andrew Cooper +Suggested-by: Tony Luck +Signed-off-by: Pawan Gupta +Signed-off-by: Borislav Petkov +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/a932c154772f2121794a5f2eded1a11013114711.1657846269.git.pawan.kumar.gupta@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst | 14 +++ + arch/x86/include/asm/cpufeatures.h | 3 + arch/x86/kernel/cpu/bugs.c | 14 +++ + arch/x86/kernel/cpu/common.c | 40 ++++++---- + 4 files changed, 54 insertions(+), 17 deletions(-) + +--- a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst ++++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst +@@ -230,6 +230,20 @@ The possible values in this file are: + * - 'Mitigation: Clear CPU buffers' + - The processor is vulnerable and the CPU buffer clearing mitigation is + enabled. ++ * - 'Unknown: No mitigations' ++ - The processor vulnerability status is unknown because it is ++ out of Servicing period. Mitigation is not attempted. ++ ++Definitions: ++------------ ++ ++Servicing period: The process of providing functional and security updates to ++Intel processors or platforms, utilizing the Intel Platform Update (IPU) ++process or other similar mechanisms. ++ ++End of Servicing Updates (ESU): ESU is the date at which Intel will no ++longer provide Servicing, such as through IPU or other similar update ++processes. ESU dates will typically be aligned to end of quarter. + + If the processor is vulnerable then the following information is appended to + the above information: +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -407,6 +407,7 @@ + #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */ + #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */ + #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */ +-#define X86_BUG_EIBRS_PBRSB X86_BUG(26) /* EIBRS is vulnerable to Post Barrier RSB Predictions */ ++#define X86_BUG_MMIO_UNKNOWN X86_BUG(26) /* CPU is too old and its MMIO Stale Data status is unknown */ ++#define X86_BUG_EIBRS_PBRSB X86_BUG(27) /* EIBRS is vulnerable to Post Barrier RSB Predictions */ + + #endif /* _ASM_X86_CPUFEATURES_H */ +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -396,7 +396,8 @@ static void __init mmio_select_mitigatio + u64 ia32_cap; + + if (!boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA) || +- cpu_mitigations_off()) { ++ boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN) || ++ cpu_mitigations_off()) { + mmio_mitigation = MMIO_MITIGATION_OFF; + return; + } +@@ -501,6 +502,8 @@ out: + pr_info("TAA: %s\n", taa_strings[taa_mitigation]); + if (boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA)) + pr_info("MMIO Stale Data: %s\n", mmio_strings[mmio_mitigation]); ++ else if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN)) ++ pr_info("MMIO Stale Data: Unknown: No mitigations\n"); + } + + static void __init md_clear_select_mitigation(void) +@@ -1880,6 +1883,9 @@ static ssize_t tsx_async_abort_show_stat + + static ssize_t mmio_stale_data_show_state(char *buf) + { ++ if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN)) ++ return sysfs_emit(buf, "Unknown: No mitigations\n"); ++ + if (mmio_mitigation == MMIO_MITIGATION_OFF) + return sysfs_emit(buf, "%s\n", mmio_strings[mmio_mitigation]); + +@@ -2007,6 +2013,7 @@ static ssize_t cpu_show_common(struct de + return srbds_show_state(buf); + + case X86_BUG_MMIO_STALE_DATA: ++ case X86_BUG_MMIO_UNKNOWN: + return mmio_stale_data_show_state(buf); + + default: +@@ -2063,6 +2070,9 @@ ssize_t cpu_show_srbds(struct device *de + + ssize_t cpu_show_mmio_stale_data(struct device *dev, struct device_attribute *attr, char *buf) + { +- return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA); ++ if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN)) ++ return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_UNKNOWN); ++ else ++ return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA); + } + #endif +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1026,6 +1026,7 @@ static void identify_cpu_without_cpuid(s + #define NO_ITLB_MULTIHIT BIT(7) + #define NO_SPECTRE_V2 BIT(8) + #define NO_EIBRS_PBRSB BIT(9) ++#define NO_MMIO BIT(10) + + #define VULNWL(_vendor, _family, _model, _whitelist) \ + { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist } +@@ -1046,6 +1047,11 @@ static const __initconst struct x86_cpu_ + VULNWL(NSC, 5, X86_MODEL_ANY, NO_SPECULATION), + + /* Intel Family 6 */ ++ VULNWL_INTEL(TIGERLAKE, NO_MMIO), ++ VULNWL_INTEL(TIGERLAKE_L, NO_MMIO), ++ VULNWL_INTEL(ALDERLAKE, NO_MMIO), ++ VULNWL_INTEL(ALDERLAKE_L, NO_MMIO), ++ + VULNWL_INTEL(ATOM_SALTWELL, NO_SPECULATION | NO_ITLB_MULTIHIT), + VULNWL_INTEL(ATOM_SALTWELL_TABLET, NO_SPECULATION | NO_ITLB_MULTIHIT), + VULNWL_INTEL(ATOM_SALTWELL_MID, NO_SPECULATION | NO_ITLB_MULTIHIT), +@@ -1064,9 +1070,9 @@ static const __initconst struct x86_cpu_ + VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT), + VULNWL_INTEL(ATOM_AIRMONT_NP, NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), + +- VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), +- VULNWL_INTEL(ATOM_GOLDMONT_D, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), +- VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB), ++ VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), ++ VULNWL_INTEL(ATOM_GOLDMONT_D, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), ++ VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_EIBRS_PBRSB), + + /* + * Technically, swapgs isn't serializing on AMD (despite it previously +@@ -1081,18 +1087,18 @@ static const __initconst struct x86_cpu_ + VULNWL_INTEL(ATOM_TREMONT_D, NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB), + + /* AMD Family 0xf - 0x12 */ +- VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT), +- VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT), +- VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT), +- VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT), ++ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), ++ VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), ++ VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), ++ VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), + + /* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */ +- VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT), +- VULNWL_HYGON(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT), ++ VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), ++ VULNWL_HYGON(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), + + /* Zhaoxin Family 7 */ +- VULNWL(CENTAUR, 7, X86_MODEL_ANY, NO_SPECTRE_V2), +- VULNWL(ZHAOXIN, 7, X86_MODEL_ANY, NO_SPECTRE_V2), ++ VULNWL(CENTAUR, 7, X86_MODEL_ANY, NO_SPECTRE_V2 | NO_MMIO), ++ VULNWL(ZHAOXIN, 7, X86_MODEL_ANY, NO_SPECTRE_V2 | NO_MMIO), + {} + }; + +@@ -1234,10 +1240,16 @@ static void __init cpu_set_bug_bits(stru + * Affected CPU list is generally enough to enumerate the vulnerability, + * but for virtualization case check for ARCH_CAP MSR bits also, VMM may + * not want the guest to enumerate the bug. ++ * ++ * Set X86_BUG_MMIO_UNKNOWN for CPUs that are neither in the blacklist, ++ * nor in the whitelist and also don't enumerate MSR ARCH_CAP MMIO bits. + */ +- if (cpu_matches(cpu_vuln_blacklist, MMIO) && +- !arch_cap_mmio_immune(ia32_cap)) +- setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA); ++ if (!arch_cap_mmio_immune(ia32_cap)) { ++ if (cpu_matches(cpu_vuln_blacklist, MMIO)) ++ setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA); ++ else if (!cpu_matches(cpu_vuln_whitelist, NO_MMIO)) ++ setup_force_cpu_bug(X86_BUG_MMIO_UNKNOWN); ++ } + + if (cpu_has(c, X86_FEATURE_IBRS_ENHANCED) && + !cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&