1. 02 7月, 2021 15 次提交
  2. 24 6月, 2021 5 次提交
  3. 17 6月, 2021 1 次提交
    • K
      perf/x86: Reset the dirty counter to prevent the leak for an RDPMC task · 5471eea5
      Kan Liang 提交于
      The counter value of a perf task may leak to another RDPMC task.
      For example, a perf stat task as below is running on CPU 0.
      
          perf stat -e 'branches,cycles' -- taskset -c 0 ./workload
      
      In the meantime, an RDPMC task, which is also running on CPU 0, may read
      the GP counters periodically. (The RDPMC task creates a fixed event,
      but read four GP counters.)
      
          $./rdpmc_read_all_counters
          index 0x0 value 0x8001e5970f99
          index 0x1 value 0x8005d750edb6
          index 0x2 value 0x0
          index 0x3 value 0x0
      
          index 0x0 value 0x8002358e48a5
          index 0x1 value 0x8006bd1e3bc9
          index 0x2 value 0x0
          index 0x3 value 0x0
      
      It is a potential security issue. Once the attacker knows what the other
      thread is counting. The PerfMon counter can be used as a side-channel to
      attack cryptosystems.
      
      The counter value of the perf stat task leaks to the RDPMC task because
      perf never clears the counter when it's stopped.
      
      Three methods were considered to address the issue.
      
       - Unconditionally reset the counter in x86_pmu_del(). It can bring extra
         overhead even when there is no RDPMC task running.
      
       - Only reset the un-assigned dirty counters when the RDPMC task is
         scheduled in via sched_task(). It fails for the below case.
      
      	Thread A			Thread B
      
      	clone(CLONE_THREAD) --->
      	set_affine(0)
      					set_affine(1)
      					while (!event-enabled)
      						;
      	event = perf_event_open()
      	mmap(event)
      	ioctl(event, IOC_ENABLE); --->
      					RDPMC
      
         Counters are still leaked to the thread B.
      
       - Only reset the un-assigned dirty counters before updating the CR4.PCE
         bit. The method is implemented here.
      
      The dirty counter is a counter, on which the assigned event has been
      deleted, but the counter is not reset. To track the dirty counters,
      add a 'dirty' variable in the struct cpu_hw_events.
      
      The security issue can only be found with an RDPMC task. To enable the
      RDMPC, the CR4.PCE bit has to be updated. Add a
      perf_clear_dirty_counters() right before updating the CR4.PCE bit to
      clear the existing dirty counters. Only the current un-assigned dirty
      counters are reset, because the RDPMC assigned dirty counters will be
      updated soon.
      
      After applying the patch,
      
              $ ./rdpmc_read_all_counters
              index 0x0 value 0x0
              index 0x1 value 0x0
              index 0x2 value 0x0
              index 0x3 value 0x0
      
              index 0x0 value 0x0
              index 0x1 value 0x0
              index 0x2 value 0x0
              index 0x3 value 0x0
      
      Performance
      
      The performance of a context switch only be impacted when there are two
      or more perf users and one of the users must be an RDPMC user. In other
      cases, there is no performance impact.
      
      The worst-case occurs when there are two users: the RDPMC user only
      uses one counter; while the other user uses all available counters.
      When the RDPMC task is scheduled in, all the counters, other than the
      RDPMC assigned one, have to be reset.
      
      Test results for the worst-case, using a modified lat_ctx as measured
      on an Ice Lake platform, which has 8 GP and 3 FP counters (ignoring
      SLOTS).
      
          lat_ctx -s 128K -N 1000 processes 2
      
      Without the patch:
        The context switch time is 4.97 us
      
      With the patch:
        The context switch time is 5.16 us
      
      There is ~4% performance drop for the context switching time in the
      worst-case.
      Suggested-by: NPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: NKan Liang <kan.liang@linux.intel.com>
      Signed-off-by: NPeter Zijlstra (Intel) <peterz@infradead.org>
      Link: https://lkml.kernel.org/r/1623693582-187370-1-git-send-email-kan.liang@linux.intel.com
      5471eea5
  4. 03 6月, 2021 1 次提交
  5. 01 6月, 2021 3 次提交
  6. 27 5月, 2021 3 次提交
  7. 18 5月, 2021 3 次提交
  8. 12 5月, 2021 2 次提交
  9. 11 5月, 2021 4 次提交
    • R
      btrfs: handle transaction start error in btrfs_fileattr_set · 9b8a233b
      Ritesh Harjani 提交于
      Add error handling in btrfs_fileattr_set in case of an error while
      starting a transaction. This fixes btrfs/232 which otherwise used to
      fail with below signature on Power.
      
        btrfs/232 [ 1119.474650] run fstests btrfs/232 at 2021-04-21 02:21:22
        <...>
        [ 1366.638585] BUG: Unable to handle kernel data access on read at 0xffffffffffffff86
        [ 1366.638768] Faulting instruction address: 0xc0000000009a5c88
        cpu 0x0: Vector: 380 (Data SLB Access) at [c000000014f177b0]
            pc: c0000000009a5c88: btrfs_update_root_times+0x58/0xc0
            lr: c0000000009a5c84: btrfs_update_root_times+0x54/0xc0
            <...>
            pid   = 24881, comm = fsstress
      	   btrfs_update_inode+0xa0/0x140
      	   btrfs_fileattr_set+0x5d0/0x6f0
      	   vfs_fileattr_set+0x2a8/0x390
      	   do_vfs_ioctl+0x1290/0x1ac0
      	   sys_ioctl+0x6c/0x120
      	   system_call_exception+0x3d4/0x410
      	   system_call_common+0xec/0x278
      
      Fixes: 97fc2977 ("btrfs: convert to fileattr")
      Signed-off-by: NRitesh Harjani <riteshh@linux.ibm.com>
      Reviewed-by: NDavid Sterba <dsterba@suse.com>
      Signed-off-by: NDavid Sterba <dsterba@suse.com>
      9b8a233b
    • L
      Merge tag 'perf-tools-fixes-for-v5.13-2021-05-10' of... · 1140ab59
      Linus Torvalds 提交于
      Merge tag 'perf-tools-fixes-for-v5.13-2021-05-10' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux
      
      Pull perf tools fixes from Arnaldo Carvalho de Melo:
      
       - Fix swapping of cpu_map and stat_config records.
      
       - Fix dynamic libbpf linking.
      
       - Disallow -c and -F option at the same time in 'perf record'.
      
       - Update headers with the kernel originals.
      
       - Silence warning for JSON ArchStd files.
      
       - Fix a build error on arm64 with clang.
      
      * tag 'perf-tools-fixes-for-v5.13-2021-05-10' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
        tools headers UAPI: Sync perf_event.h with the kernel sources
        tools headers cpufeatures: Sync with the kernel sources
        tools include UAPI powerpc: Sync errno.h with the kernel headers
        tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy'
        tools headers UAPI: Sync linux/prctl.h with the kernel sources
        tools headers UAPI: Sync files changed by landlock, quotactl_path and mount_settattr new syscalls
        perf tools: Fix a build error on arm64 with clang
        tools headers kvm: Sync kvm headers with the kernel sources
        tools headers UAPI: Sync linux/kvm.h with the kernel sources
        perf tools: Fix dynamic libbpf link
        perf session: Fix swapping of cpu_map and stat_config records
        perf jevents: Silence warning for ArchStd files
        perf record: Disallow -c and -F option at the same time
        tools arch x86: Sync the msr-index.h copy with the kernel sources
        tools headers UAPI: Sync drm/i915_drm.h with the kernel sources
        tools headers UAPI: Update tools's copy of drm.h headers
      1140ab59
    • L
      Merge tag 'for-5.13-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 142b507f
      Linus Torvalds 提交于
      Pull btrfs fixes from David Sterba:
       "First batch of various fixes, here's a list of notable ones:
      
         - fix unmountable seed device after fstrim
      
         - fix silent data loss in zoned mode due to ordered extent splitting
      
         - fix race leading to unpersisted data and metadata on fsync
      
         - fix deadlock when cloning inline extents and using qgroups"
      
      * tag 'for-5.13-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: initialize return variable in cleanup_free_space_cache_v1
        btrfs: zoned: sanity check zone type
        btrfs: fix unmountable seed device after fstrim
        btrfs: fix deadlock when cloning inline extents and using qgroups
        btrfs: fix race leading to unpersisted data and metadata on fsync
        btrfs: do not consider send context as valid when trying to flush qgroups
        btrfs: zoned: fix silent data loss after failure splitting ordered extent
      142b507f
    • L
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 0aa099a3
      Linus Torvalds 提交于
      Pull kvm fixes from Paolo Bonzini:
      
       - Lots of bug fixes.
      
       - Fix virtualization of RDPID
      
       - Virtualization of DR6_BUS_LOCK, which on bare metal is new to this
         release
      
       - More nested virtualization migration fixes (nSVM and eVMCS)
      
       - Fix for KVM guest hibernation
      
       - Fix for warning in SEV-ES SRCU usage
      
       - Block KVM from loading on AMD machines with 5-level page tables, due
         to the APM not mentioning how host CR4.LA57 exactly impacts the
         guest.
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (48 commits)
        KVM: SVM: Move GHCB unmapping to fix RCU warning
        KVM: SVM: Invert user pointer casting in SEV {en,de}crypt helpers
        kvm: Cap halt polling at kvm->max_halt_poll_ns
        tools/kvm_stat: Fix documentation typo
        KVM: x86: Prevent deadlock against tk_core.seq
        KVM: x86: Cancel pvclock_gtod_work on module removal
        KVM: x86: Prevent KVM SVM from loading on kernels with 5-level paging
        KVM: X86: Expose bus lock debug exception to guest
        KVM: X86: Add support for the emulation of DR6_BUS_LOCK bit
        KVM: PPC: Book3S HV: Fix conversion to gfn-based MMU notifier callbacks
        KVM: x86: Hide RDTSCP and RDPID if MSR_TSC_AUX probing failed
        KVM: x86: Tie Intel and AMD behavior for MSR_TSC_AUX to guest CPU model
        KVM: x86: Move uret MSR slot management to common x86
        KVM: x86: Export the number of uret MSRs to vendor modules
        KVM: VMX: Disable loading of TSX_CTRL MSR the more conventional way
        KVM: VMX: Use common x86's uret MSR list as the one true list
        KVM: VMX: Use flag to indicate "active" uret MSRs instead of sorting list
        KVM: VMX: Configure list of user return MSRs at module init
        KVM: x86: Add support for RDPID without RDTSCP
        KVM: SVM: Probe and load MSR_TSC_AUX regardless of RDTSCP support in host
        ...
      0aa099a3
  10. 10 5月, 2021 3 次提交
    • A
      tools headers UAPI: Sync perf_event.h with the kernel sources · 71d7924b
      Arnaldo Carvalho de Melo 提交于
      To pick up the changes in:
      
        2b26f0aa ("perf: Support only inheriting events if cloned with CLONE_THREAD")
        2e498d0a ("perf: Add support for event removal on exec")
        547b6098 ("perf: aux: Add flags for the buffer format")
        55bcf6ef ("perf: Extend PERF_TYPE_HARDWARE and PERF_TYPE_HW_CACHE")
        7dde5176 ("perf: aux: Add CoreSight PMU buffer formats")
        97ba62b2 ("perf: Add support for SIGTRAP on perf events")
        d0d1dd62 ("perf core: Add PERF_COUNT_SW_CGROUP_SWITCHES event")
      
      Also change the expected sizeof(struct perf_event_attr) from 120 to 128 due to
      fields being added for the SIGTRAP changes.
      
      Addressing this perf build warning:
      
        Warning: Kernel ABI header at 'tools/include/uapi/linux/perf_event.h' differs from latest version at 'include/uapi/linux/perf_event.h'
        diff -u tools/include/uapi/linux/perf_event.h include/uapi/linux/perf_event.h
      
      Cc: Kan Liang <kan.liang@linux.intel.com>
      Cc: Marco Elver <elver@google.com>
      Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
      Signed-off-by: NArnaldo Carvalho de Melo <acme@redhat.com>
      71d7924b
    • A
      tools headers cpufeatures: Sync with the kernel sources · 6faf64f5
      Arnaldo Carvalho de Melo 提交于
      To pick the changes from:
      
        4e629211 ("x86/paravirt: Add new features for paravirt patching")
        a161545a ("x86/cpufeatures: Enumerate Intel Hybrid Technology feature bit")
        a89dfde3 ("x86: Remove dynamic NOP selection")
        b8921dcc ("x86/cpufeatures: Add SGX1 and SGX2 sub-features")
        f21d4d3b ("x86/cpufeatures: Enumerate #DB for bus lock detection")
        f333374e ("x86/cpufeatures: Add the Virtual SPEC_CTRL feature")
      
      This only causes these perf files to be rebuilt:
      
        CC       /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o
        CC       /tmp/build/perf/bench/mem-memset-x86-64-asm.o
      
      And addresses this perf build warning:
      
        Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h'
        diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h
      
      Cc: Babu Moger <babu.moger@amd.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
      Cc: Sean Christopherson <seanjc@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: NArnaldo Carvalho de Melo <acme@redhat.com>
      6faf64f5
    • A
      tools include UAPI powerpc: Sync errno.h with the kernel headers · 39163293
      Arnaldo Carvalho de Melo 提交于
      To pick the change in:
      
        7de21e67 ("powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h")
      
      That will make the errno number -> string tables to pick this change on powerpc.
      
      Silencing this perf build warning:
      
        Warning: Kernel ABI header at 'tools/arch/powerpc/include/uapi/asm/errno.h' differs from latest version at 'arch/powerpc/include/uapi/asm/errno.h'
        diff -u tools/arch/powerpc/include/uapi/asm/errno.h arch/powerpc/include/uapi/asm/errno.h
      
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Tony Ambardar <tony.ambardar@gmail.com>
      Signed-off-by: NArnaldo Carvalho de Melo <acme@redhat.com>
      39163293