1. 08 Nov, 2017 6 commits
    • Ricardo Neri's avatar
      x86/insn-eval: Add support to resolve 16-bit address encodings · 9c6c799f
      Ricardo Neri authored
      Tasks running in virtual-8086 mode, in protected mode with code segment
      descriptors that specify 16-bit default address sizes via the D bit, or via
      an address override prefix will use 16-bit addressing form encodings as
      described in the Intel 64 and IA-32 Architecture Software Developer's
      Manual Volume 2A Section 2.1.5, Table 2-1.
      
      16-bit addressing encodings differ in several ways from the 32-bit/64-bit
      addressing form encodings: ModRM.rm points to different registers and, in
      some cases, effective addresses are indicated by the addition of the value
      of two registers. Also, there is no support for SIB bytes. Thus, a
      separate function is needed to parse this form of addressing.
      
      Three functions are introduced. get_reg_offset_16() obtains the
      offset from the base of pt_regs of the registers indicated by the ModRM
      byte of the address encoding. get_eff_addr_modrm_16() computes the
      effective address from the value of the register operands.
      get_addr_ref_16() computes the linear address using the obtained effective
      address and the base address of the segment.
      
      Segment limits are enforced when running in protected mode.
      Signed-off-by: default avatarRicardo Neri <ricardo.neri-calderon@linux.intel.com>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Chen Yucong <slaoub@gmail.com>
      Cc: Chris Metcalf <cmetcalf@mellanox.com>
      Cc: Colin Ian King <colin.king@canonical.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Huang Rui <ray.huang@amd.com>
      Cc: Jiri Slaby <jslaby@suse.cz>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Lorenzo Stoakes <lstoakes@gmail.com>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Qiaowei Ren <qiaowei.ren@intel.com>
      Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
      Cc: Shuah Khan <shuah@kernel.org>
      Cc: Thomas Garnier <thgarnie@google.com>
      Cc: Tony Luck <tony.luck@intel.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: ricardo.neri@intel.com
      Link: http://lkml.kernel.org/r/1509935277-22138-6-git-send-email-ricardo.neri-calderon@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      9c6c799f
    • Ricardo Neri's avatar
      x86/insn-eval: Handle 32-bit address encodings in virtual-8086 mode · 86cc3510
      Ricardo Neri authored
      It is possible to utilize 32-bit address encodings in virtual-8086 mode via
      an address override instruction prefix. However, the range of the
      effective address is still limited to [0x-0xffff]. In such a case, return
      error.
      
      Also, linear addresses in virtual-8086 mode are limited to 20 bits. Enforce
      such limit by truncating the most significant bytes of the computed linear
      address.
      Signed-off-by: default avatarRicardo Neri <ricardo.neri-calderon@linux.intel.com>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Chen Yucong <slaoub@gmail.com>
      Cc: Chris Metcalf <cmetcalf@mellanox.com>
      Cc: Colin Ian King <colin.king@canonical.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Huang Rui <ray.huang@amd.com>
      Cc: Jiri Slaby <jslaby@suse.cz>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Lorenzo Stoakes <lstoakes@gmail.com>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Qiaowei Ren <qiaowei.ren@intel.com>
      Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
      Cc: Shuah Khan <shuah@kernel.org>
      Cc: Thomas Garnier <thgarnie@google.com>
      Cc: Tony Luck <tony.luck@intel.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: ricardo.neri@intel.com
      Link: http://lkml.kernel.org/r/1509935277-22138-5-git-send-email-ricardo.neri-calderon@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      86cc3510
    • Ricardo Neri's avatar
      x86/insn-eval: Add wrapper function for 32 and 64-bit addresses · cd9b594a
      Ricardo Neri authored
      The function insn_get_addr_ref() is capable of handling only 64-bit
      addresses. A previous commit introduced a function to handle 32-bit
      addresses. Invoke these two functions from a third wrapper function that
      calls the appropriate routine based on the address size specified in the
      instruction structure (obtained by looking at the code segment default
      address size and the address override prefix, if present).
      
      While doing this, rename the original function insn_get_addr_ref() with
      the more appropriate name get_addr_ref_64(), ensure it is only used
      for 64-bit addresses.
      
      Also, since 64-bit addresses are not possible in 32-bit builds, provide
      a dummy function such case.
      Signed-off-by: default avatarRicardo Neri <ricardo.neri-calderon@linux.intel.com>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Chen Yucong <slaoub@gmail.com>
      Cc: Chris Metcalf <cmetcalf@mellanox.com>
      Cc: Colin Ian King <colin.king@canonical.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Huang Rui <ray.huang@amd.com>
      Cc: Jiri Slaby <jslaby@suse.cz>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Lorenzo Stoakes <lstoakes@gmail.com>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Qiaowei Ren <qiaowei.ren@intel.com>
      Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
      Cc: Shuah Khan <shuah@kernel.org>
      Cc: Thomas Garnier <thgarnie@google.com>
      Cc: Tony Luck <tony.luck@intel.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: ricardo.neri@intel.com
      Link: http://lkml.kernel.org/r/1509935277-22138-4-git-send-email-ricardo.neri-calderon@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      cd9b594a
    • Ricardo Neri's avatar
      x86/insn-eval: Add support to resolve 32-bit address encodings · 7a6daf79
      Ricardo Neri authored
      32-bit and 64-bit address encodings are identical. Thus, the same logic
      could be used to resolve the effective address. However, there are two key
      differences: address size and enforcement of segment limits.
      
      If running a 32-bit process on a 64-bit kernel, it is best to perform
      the address calculation using 32-bit data types. In this manner hardware
      is used for the arithmetic, including handling of signs and overflows.
      
      32-bit addresses are generally used in protected mode; segment limits are
      enforced in this mode. This implementation obtains the limit of the
      segment associated with the instruction operands and prefixes. If the
      computed address is outside the segment limits, an error is returned. It
      is also possible to use 32-bit address in long mode and virtual-8086 mode
      by using an address override prefix. In such cases, segment limits are not
      enforced.
      
      Support to use 32-bit arithmetic is added to the utility functions that
      compute effective addresses. However, the end result is stored in a
      variable of type long (which has a width of 8 bytes in 64-bit builds).
      Hence, once a 32-bit effective address is computed, the 4 most significant
      bytes are masked out to avoid sign extension.
      
      The newly added function get_addr_ref_32() is almost identical to the
      existing function insn_get_addr_ref() (used for 64-bit addresses). The only
      difference is that it verifies that the effective address is within the
      limits of the segment.
      Signed-off-by: default avatarRicardo Neri <ricardo.neri-calderon@linux.intel.com>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Chen Yucong <slaoub@gmail.com>
      Cc: Chris Metcalf <cmetcalf@mellanox.com>
      Cc: Colin Ian King <colin.king@canonical.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Huang Rui <ray.huang@amd.com>
      Cc: Jiri Slaby <jslaby@suse.cz>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Lorenzo Stoakes <lstoakes@gmail.com>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Qiaowei Ren <qiaowei.ren@intel.com>
      Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
      Cc: Shuah Khan <shuah@kernel.org>
      Cc: Thomas Garnier <thgarnie@google.com>
      Cc: Tony Luck <tony.luck@intel.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: ricardo.neri@intel.com
      Link: http://lkml.kernel.org/r/1509935277-22138-3-git-send-email-ricardo.neri-calderon@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      7a6daf79
    • Ricardo Neri's avatar
      x86/insn-eval: Compute linear address in several utility functions · 70e57c0f
      Ricardo Neri authored
      Computing a linear address involves several steps. The first step is to
      compute the effective address. This requires determining the addressing
      mode in use and perform arithmetic operations on the operands. Plus, each
      addressing mode has special cases that must be handled.
      
      Once the effective address is known, the base address of the applicable
      segment is added to obtain the linear address.
      
      Clearly, this is too much work for a single function. Instead, handle each
      addressing mode in a separate utility function. This improves readability
      and gives us the opportunity to handler errors better.
      
      At the moment, arithmetic to compute the effective address uses 64-byte
      variables. Thus, limit support to 64-bit addresses.
      
      While reworking the function insn_get_addr_ref(), the variable addr_offset
      is renamed as regoff to reflect its actual use (i.e., offset, from the
      base of pt_regs, of the register used as operand).
      Suggested-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarRicardo Neri <ricardo.neri-calderon@linux.intel.com>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Chen Yucong <slaoub@gmail.com>
      Cc: Chris Metcalf <cmetcalf@mellanox.com>
      Cc: Colin Ian King <colin.king@canonical.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Huang Rui <ray.huang@amd.com>
      Cc: Jiri Slaby <jslaby@suse.cz>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Lorenzo Stoakes <lstoakes@gmail.com>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Qiaowei Ren <qiaowei.ren@intel.com>
      Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
      Cc: Shuah Khan <shuah@kernel.org>
      Cc: Thomas Garnier <thgarnie@google.com>
      Cc: Tony Luck <tony.luck@intel.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: ricardo.neri@intel.com
      Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      70e57c0f
    • Ingo Molnar's avatar
      Merge branch 'x86/mpx' into x86/asm, to pick up dependent commits · 93c08089
      Ingo Molnar authored
      The UMIP series is based on top of changes already queued up in the x86/mpx branch,
      so merge it.
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      93c08089
  2. 07 Nov, 2017 32 commits
  3. 06 Nov, 2017 2 commits
    • Linus Torvalds's avatar
      Merge branch 'for-4.14-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq · e4880bc5
      Linus Torvalds authored
      Pull workqueue fix from Tejun Heo:
       "Another fix for a really old bug.
      
        It only affects drain_workqueue() which isn't used often and even then
        triggers only during a pretty small race window, so it isn't too
        surprising that it stayed hidden for so long.
      
        The fix is straight-forward and low-risk. Kudos to Li Bin for
        reporting and fixing the bug"
      
      * 'for-4.14-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
        workqueue: Fix NULL pointer dereference
      e4880bc5
    • Tobin C. Harding's avatar
      scripts: add leaking_addresses.pl · 136fc5c4
      Tobin C. Harding authored
      Currently we are leaking addresses from the kernel to user space. This
      script is an attempt to find some of those leakages. Script parses
      `dmesg` output and /proc and /sys files for hex strings that look like
      kernel addresses.
      
      Only works for 64 bit kernels, the reason being that kernel addresses on
      64 bit kernels have 'ffff' as the leading bit pattern making greping
      possible. On 32 kernels we don't have this luxury.
      
      Scripts is _slightly_ smarter than a straight grep, we check for false
      positives (all 0's or all 1's, and vsyscall start/finish addresses).
      
      [ I think there is a lot of room for improvement here, but it's already
        useful, so I'm merging it as-is. The whole "hash %p format" series is
        expected to go into 4.15, but will not fix %x users, and will not
        incentivize people to look at what they are leaking.     - Linus ]
      Signed-off-by: default avatarTobin C. Harding <me@tobin.cc>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      136fc5c4