tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'x86-urgent-2025-03-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull misc x86 fixes from Ingo Molnar:

- Fix CPUID leaf 0x2 parsing bugs

- Sanitize very early boot parameters to avoid crash

- Fix size overflows in the SGX code

- Make CALL_NOSPEC use consistent

* tag 'x86-urgent-2025-03-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot: Sanitize boot params before parsing command line
x86/sgx: Fix size overflows in sgx_encl_create()
x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
x86/cpu: Validate CPUID leaf 0x2 EDX output
x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
x86/speculation: Add a conditional CS prefix to CALL_NOSPEC
x86/speculation: Simplify and make CALL_NOSPEC consistent

Linus Torvalds 042751d3 8287dfc2

+64 -31
+2
arch/x86/boot/compressed/pgtable_64.c
··· 1 1 // SPDX-License-Identifier: GPL-2.0 2 2 #include "misc.h" 3 3 #include <asm/bootparam.h> 4 + #include <asm/bootparam_utils.h> 4 5 #include <asm/e820/types.h> 5 6 #include <asm/processor.h> 6 7 #include "pgtable.h" ··· 108 107 bool l5_required = false; 109 108 110 109 /* Initialize boot_params. Required for cmdline_find_option_bool(). */ 110 + sanitize_boot_params(bp); 111 111 boot_params_ptr = bp; 112 112 113 113 /*
+19 -13
arch/x86/include/asm/nospec-branch.h
··· 198 198 .endm 199 199 200 200 /* 201 - * Equivalent to -mindirect-branch-cs-prefix; emit the 5 byte jmp/call 202 - * to the retpoline thunk with a CS prefix when the register requires 203 - * a RAX prefix byte to encode. Also see apply_retpolines(). 201 + * Emits a conditional CS prefix that is compatible with 202 + * -mindirect-branch-cs-prefix. 204 203 */ 205 204 .macro __CS_PREFIX reg:req 206 205 .irp rs,r8,r9,r10,r11,r12,r13,r14,r15 ··· 420 421 #ifdef CONFIG_X86_64 421 422 422 423 /* 424 + * Emits a conditional CS prefix that is compatible with 425 + * -mindirect-branch-cs-prefix. 426 + */ 427 + #define __CS_PREFIX(reg) \ 428 + ".irp rs,r8,r9,r10,r11,r12,r13,r14,r15\n" \ 429 + ".ifc \\rs," reg "\n" \ 430 + ".byte 0x2e\n" \ 431 + ".endif\n" \ 432 + ".endr\n" 433 + 434 + /* 423 435 * Inline asm uses the %V modifier which is only in newer GCC 424 436 * which is ensured when CONFIG_MITIGATION_RETPOLINE is defined. 425 437 */ 426 - # define CALL_NOSPEC \ 427 - ALTERNATIVE_2( \ 428 - ANNOTATE_RETPOLINE_SAFE \ 429 - "call *%[thunk_target]\n", \ 430 - "call __x86_indirect_thunk_%V[thunk_target]\n", \ 431 - X86_FEATURE_RETPOLINE, \ 432 - "lfence;\n" \ 433 - ANNOTATE_RETPOLINE_SAFE \ 434 - "call *%[thunk_target]\n", \ 435 - X86_FEATURE_RETPOLINE_LFENCE) 438 + #ifdef CONFIG_MITIGATION_RETPOLINE 439 + #define CALL_NOSPEC __CS_PREFIX("%V[thunk_target]") \ 440 + "call __x86_indirect_thunk_%V[thunk_target]\n" 441 + #else 442 + #define CALL_NOSPEC "call *%[thunk_target]\n" 443 + #endif 436 444 437 445 # define THUNK_TARGET(addr) [thunk_target] "r" (addr) 438 446
+1 -1
arch/x86/kernel/cpu/cacheinfo.c
··· 808 808 cpuid(2, &regs[0], &regs[1], &regs[2], &regs[3]); 809 809 810 810 /* If bit 31 is set, this is an unknown format */ 811 - for (j = 0 ; j < 3 ; j++) 811 + for (j = 0 ; j < 4 ; j++) 812 812 if (regs[j] & (1 << 31)) 813 813 regs[j] = 0; 814 814
+35 -17
arch/x86/kernel/cpu/intel.c
··· 635 635 } 636 636 #endif 637 637 638 - #define TLB_INST_4K 0x01 639 - #define TLB_INST_4M 0x02 640 - #define TLB_INST_2M_4M 0x03 638 + #define TLB_INST_4K 0x01 639 + #define TLB_INST_4M 0x02 640 + #define TLB_INST_2M_4M 0x03 641 641 642 - #define TLB_INST_ALL 0x05 643 - #define TLB_INST_1G 0x06 642 + #define TLB_INST_ALL 0x05 643 + #define TLB_INST_1G 0x06 644 644 645 - #define TLB_DATA_4K 0x11 646 - #define TLB_DATA_4M 0x12 647 - #define TLB_DATA_2M_4M 0x13 648 - #define TLB_DATA_4K_4M 0x14 645 + #define TLB_DATA_4K 0x11 646 + #define TLB_DATA_4M 0x12 647 + #define TLB_DATA_2M_4M 0x13 648 + #define TLB_DATA_4K_4M 0x14 649 649 650 - #define TLB_DATA_1G 0x16 650 + #define TLB_DATA_1G 0x16 651 + #define TLB_DATA_1G_2M_4M 0x17 651 652 652 - #define TLB_DATA0_4K 0x21 653 - #define TLB_DATA0_4M 0x22 654 - #define TLB_DATA0_2M_4M 0x23 653 + #define TLB_DATA0_4K 0x21 654 + #define TLB_DATA0_4M 0x22 655 + #define TLB_DATA0_2M_4M 0x23 655 656 656 - #define STLB_4K 0x41 657 - #define STLB_4K_2M 0x42 657 + #define STLB_4K 0x41 658 + #define STLB_4K_2M 0x42 659 + 660 + /* 661 + * All of leaf 0x2's one-byte TLB descriptors implies the same number of 662 + * entries for their respective TLB types. The 0x63 descriptor is an 663 + * exception: it implies 4 dTLB entries for 1GB pages 32 dTLB entries 664 + * for 2MB or 4MB pages. Encode descriptor 0x63 dTLB entry count for 665 + * 2MB/4MB pages here, as its count for dTLB 1GB pages is already at the 666 + * intel_tlb_table[] mapping. 667 + */ 668 + #define TLB_0x63_2M_4M_ENTRIES 32 658 669 659 670 static const struct _tlb_table intel_tlb_table[] = { 660 671 { 0x01, TLB_INST_4K, 32, " TLB_INST 4 KByte pages, 4-way set associative" }, ··· 687 676 { 0x5c, TLB_DATA_4K_4M, 128, " TLB_DATA 4 KByte and 4 MByte pages" }, 688 677 { 0x5d, TLB_DATA_4K_4M, 256, " TLB_DATA 4 KByte and 4 MByte pages" }, 689 678 { 0x61, TLB_INST_4K, 48, " TLB_INST 4 KByte pages, full associative" }, 690 - { 0x63, TLB_DATA_1G, 4, " TLB_DATA 1 GByte pages, 4-way set associative" }, 679 + { 0x63, TLB_DATA_1G_2M_4M, 4, " TLB_DATA 1 GByte pages, 4-way set associative" 680 + " (plus 32 entries TLB_DATA 2 MByte or 4 MByte pages, not encoded here)" }, 691 681 { 0x6b, TLB_DATA_4K, 256, " TLB_DATA 4 KByte pages, 8-way associative" }, 692 682 { 0x6c, TLB_DATA_2M_4M, 128, " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" }, 693 683 { 0x6d, TLB_DATA_1G, 16, " TLB_DATA 1 GByte pages, fully associative" }, ··· 788 776 if (tlb_lld_4m[ENTRIES] < intel_tlb_table[k].entries) 789 777 tlb_lld_4m[ENTRIES] = intel_tlb_table[k].entries; 790 778 break; 779 + case TLB_DATA_1G_2M_4M: 780 + if (tlb_lld_2m[ENTRIES] < TLB_0x63_2M_4M_ENTRIES) 781 + tlb_lld_2m[ENTRIES] = TLB_0x63_2M_4M_ENTRIES; 782 + if (tlb_lld_4m[ENTRIES] < TLB_0x63_2M_4M_ENTRIES) 783 + tlb_lld_4m[ENTRIES] = TLB_0x63_2M_4M_ENTRIES; 784 + fallthrough; 791 785 case TLB_DATA_1G: 792 786 if (tlb_lld_1g[ENTRIES] < intel_tlb_table[k].entries) 793 787 tlb_lld_1g[ENTRIES] = intel_tlb_table[k].entries; ··· 817 799 cpuid(2, &regs[0], &regs[1], &regs[2], &regs[3]); 818 800 819 801 /* If bit 31 is set, this is an unknown format */ 820 - for (j = 0 ; j < 3 ; j++) 802 + for (j = 0 ; j < 4 ; j++) 821 803 if (regs[j] & (1 << 31)) 822 804 regs[j] = 0; 823 805
+7
arch/x86/kernel/cpu/sgx/ioctl.c
··· 64 64 struct file *backing; 65 65 long ret; 66 66 67 + /* 68 + * ECREATE would detect this too, but checking here also ensures 69 + * that the 'encl_size' calculations below can never overflow. 70 + */ 71 + if (!is_power_of_2(secs->size)) 72 + return -EINVAL; 73 + 67 74 va_page = sgx_encl_grow(encl, true); 68 75 if (IS_ERR(va_page)) 69 76 return PTR_ERR(va_page);