input-xpad-add-pxn-v900-support.patch
cgroup-remove-duplicates-in-cgroup-v1-tasks-file.patch
pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch
+x86-cpu-fix-amd-erratum-1485-on-zen4-based-cpus.patch
usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toio.patch
usb-gadget-ncm-handle-decoding-of-multiple-ntb-s-in-unwrap-call.patch
powerpc-64e-fix-wrong-test-in-__ptep_test_and_clear_.patch
+x86-alternatives-disable-kasan-in-apply_alternatives.patch
--- /dev/null
+From d35652a5fc9944784f6f50a5c979518ff8dacf61 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Thu, 12 Oct 2023 13:04:24 +0300
+Subject: x86/alternatives: Disable KASAN in apply_alternatives()
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+commit d35652a5fc9944784f6f50a5c979518ff8dacf61 upstream.
+
+Fei has reported that KASAN triggers during apply_alternatives() on
+a 5-level paging machine:
+
+ BUG: KASAN: out-of-bounds in rcu_is_watching()
+ Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0
+ ...
+ __asan_load4()
+ rcu_is_watching()
+ trace_hardirqs_on()
+ text_poke_early()
+ apply_alternatives()
+ ...
+
+On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57)
+gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on
+__VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().
+
+KASAN gets confused when apply_alternatives() patches the
+KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START
+static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.
+
+Fix it for real by disabling KASAN while the kernel is patching alternatives.
+
+[ mingo: updated the changelog ]
+
+Fixes: 6657fca06e3f ("x86/mm: Allow to boot without LA57 if CONFIG_X86_5LEVEL=y")
+Reported-by: Fei Yang <fei.yang@intel.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20231012100424.1456-1-kirill.shutemov@linux.intel.com
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/alternative.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/arch/x86/kernel/alternative.c
++++ b/arch/x86/kernel/alternative.c
+@@ -366,6 +366,17 @@ void __init_or_module noinline apply_alt
+ u8 insnbuf[MAX_PATCH_LEN];
+
+ DPRINTK("alt table %px, -> %px", start, end);
++
++ /*
++ * In the case CONFIG_X86_5LEVEL=y, KASAN_SHADOW_START is defined using
++ * cpu_feature_enabled(X86_FEATURE_LA57) and is therefore patched here.
++ * During the process, KASAN becomes confused seeing partial LA57
++ * conversion and triggers a false-positive out-of-bound report.
++ *
++ * Disable KASAN until the patching is complete.
++ */
++ kasan_disable_current();
++
+ /*
+ * The scan order should be from start to end. A later scanned
+ * alternative code can overwrite previously scanned alternative code.
+@@ -426,6 +437,8 @@ void __init_or_module noinline apply_alt
+
+ text_poke_early(instr, insnbuf, insnbuf_sz);
+ }
++
++ kasan_enable_current();
+ }
+
+ #ifdef CONFIG_SMP
--- /dev/null
+From f454b18e07f518bcd0c05af17a2239138bff52de Mon Sep 17 00:00:00 2001
+From: "Borislav Petkov (AMD)" <bp@alien8.de>
+Date: Sat, 7 Oct 2023 12:57:02 +0200
+Subject: x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+commit f454b18e07f518bcd0c05af17a2239138bff52de upstream.
+
+Fix erratum #1485 on Zen4 parts where running with STIBP disabled can
+cause an #UD exception. The performance impact of the fix is negligible.
+
+Reported-by: René Rebe <rene@exactcode.de>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Tested-by: René Rebe <rene@exactcode.de>
+Cc: <stable@kernel.org>
+Link: https://lore.kernel.org/r/D99589F4-BC5D-430B-87B2-72C20370CF57@exactcode.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/msr-index.h | 4 ++++
+ arch/x86/kernel/cpu/amd.c | 8 ++++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -446,6 +446,10 @@
+
+ #define MSR_AMD64_VIRT_SPEC_CTRL 0xc001011f
+
++/* Zen4 */
++#define MSR_ZEN4_BP_CFG 0xc001102e
++#define MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT 5
++
+ /* Fam 17h MSRs */
+ #define MSR_F17H_IRPERF 0xc00000e9
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -72,6 +72,10 @@ static const int amd_zenbleed[] =
+ AMD_MODEL_RANGE(0x17, 0x90, 0x0, 0x91, 0xf),
+ AMD_MODEL_RANGE(0x17, 0xa0, 0x0, 0xaf, 0xf));
+
++static const int amd_erratum_1485[] =
++ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x19, 0x10, 0x0, 0x1f, 0xf),
++ AMD_MODEL_RANGE(0x19, 0x60, 0x0, 0xaf, 0xf));
++
+ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
+ {
+ int osvw_id = *erratum++;
+@@ -1122,6 +1126,10 @@ static void init_amd(struct cpuinfo_x86
+ check_null_seg_clears_base(c);
+
+ zenbleed_check(c);
++
++ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) &&
++ cpu_has_amd_erratum(c, amd_erratum_1485))
++ msr_set_bit(MSR_ZEN4_BP_CFG, MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT);
+ }
+
+ #ifdef CONFIG_X86_32
projects / thirdparty / kernel / stable-queue.git / commitdiff
