1. May 27, 2022
    • Lad Prabhakar's avatar
      Input: gpio-keys - cancel delayed work only in case of GPIO · cee409bb
      Lad Prabhakar authored
      
      
      gpio_keys module can either accept gpios or interrupts. The module
      initializes delayed work in case of gpios only and is only used if
      debounce timer is not used, so make sure cancel_delayed_work_sync()
      is called only when its gpio-backed and debounce_use_hrtimer is false.
      
      This fixes the issue seen below when the gpio_keys module is unloaded and
      an interrupt pin is used instead of GPIO:
      
      [  360.297569] ------------[ cut here ]------------
      [  360.302303] WARNING: CPU: 0 PID: 237 at kernel/workqueue.c:3066 __flush_work+0x414/0x470
      [  360.310531] Modules linked in: gpio_keys(-)
      [  360.314797] CPU: 0 PID: 237 Comm: rmmod Not tainted 5.18.0-rc5-arm64-renesas-00116-g73636105874d-dirty #166
      [  360.324662] Hardware name: Renesas SMARC EVK based on r9a07g054l2 (DT)
      [  360.331270] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
      [  360.338318] pc : __flush_work+0x414/0x470
      [  360.342385] lr : __cancel_work_timer+0x140/0x1b0
      [  360.347065] sp : ffff80000a7fba00
      [  360.350423] x29: ffff80000a7fba00 x28: ffff000012b9c5c0 x27: 0000000000000000
      [  360.357664] x26: ffff80000a7fbb80 x25: ffff80000954d0a8 x24: 0000000000000001
      [  360.364904] x23: ffff800009757000 x22: 0000000000000000 x21: ffff80000919b000
      [  360.372143] x20: ffff00000f5974e0 x19: ffff00000f5974e0 x18: ffff8000097fcf48
      [  360.379382] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000053f40
      [  360.386622] x14: ffff800009850e88 x13: 0000000000000002 x12: 000000000000a60c
      [  360.393861] x11: 000000000000a610 x10: 0000000000000000 x9 : 0000000000000008
      [  360.401100] x8 : 0101010101010101 x7 : 00000000a473c394 x6 : 0080808080808080
      [  360.408339] x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff80000919b458
      [  360.415578] x2 : ffff8000097577f0 x1 : 0000000000000001 x0 : 0000000000000000
      [  360.422818] Call trace:
      [  360.425299]  __flush_work+0x414/0x470
      [  360.429012]  __cancel_work_timer+0x140/0x1b0
      [  360.433340]  cancel_delayed_work_sync+0x10/0x18
      [  360.437931]  gpio_keys_quiesce_key+0x28/0x58 [gpio_keys]
      [  360.443327]  devm_action_release+0x10/0x18
      [  360.447481]  release_nodes+0x8c/0x1a0
      [  360.451194]  devres_release_all+0x90/0x100
      [  360.455346]  device_unbind_cleanup+0x14/0x60
      [  360.459677]  device_release_driver_internal+0xe8/0x168
      [  360.464883]  driver_detach+0x4c/0x90
      [  360.468509]  bus_remove_driver+0x54/0xb0
      [  360.472485]  driver_unregister+0x2c/0x58
      [  360.476462]  platform_driver_unregister+0x10/0x18
      [  360.481230]  gpio_keys_exit+0x14/0x828 [gpio_keys]
      [  360.486088]  __arm64_sys_delete_module+0x1e0/0x270
      [  360.490945]  invoke_syscall+0x40/0xf8
      [  360.494661]  el0_svc_common.constprop.3+0xf0/0x110
      [  360.499515]  do_el0_svc+0x20/0x78
      [  360.502877]  el0_svc+0x48/0xf8
      [  360.505977]  el0t_64_sync_handler+0x88/0xb0
      [  360.510216]  el0t_64_sync+0x148/0x14c
      [  360.513930] irq event stamp: 4306
      [  360.517288] hardirqs last  enabled at (4305): [<ffff8000080b0300>] __cancel_work_timer+0x130/0x1b0
      [  360.526359] hardirqs last disabled at (4306): [<ffff800008d194fc>] el1_dbg+0x24/0x88
      [  360.534204] softirqs last  enabled at (4278): [<ffff8000080104a0>] _stext+0x4a0/0x5e0
      [  360.542133] softirqs last disabled at (4267): [<ffff8000080932ac>] irq_exit_rcu+0x18c/0x1b0
      [  360.550591] ---[ end trace 0000000000000000 ]---
      
      Signed-off-by: default avatarLad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
      Link: https://lore.kernel.org/r/20220524135822.14764-1-prabhakar.mahadev-lad.rj@bp.renesas.com
      
      
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      cee409bb
  2. May 22, 2022
  3. May 19, 2022
  4. May 18, 2022
  5. May 17, 2022
  6. May 06, 2022
  7. Apr 25, 2022
  8. Apr 21, 2022
  9. Apr 18, 2022
  10. Apr 09, 2022
  11. Mar 21, 2022
  12. Mar 20, 2022
    • Borislav Petkov's avatar
      kvm/emulate: Fix SETcc emulation function offsets with SLS · fe83f5ea
      Borislav Petkov authored
      The commit in Fixes started adding INT3 after RETs as a mitigation
      against straight-line speculation.
      
      The fastop SETcc implementation in kvm's insn emulator uses macro magic
      to generate all possible SETcc functions and to jump to them when
      emulating the respective instruction.
      
      However, it hardcodes the size and alignment of those functions to 4: a
      three-byte SETcc insn and a single-byte RET. BUT, with SLS, there's an
      INT3 that gets slapped after the RET, which brings the whole scheme out
      of alignment:
      
        15:   0f 90 c0                seto   %al
        18:   c3                      ret
        19:   cc                      int3
        1a:   0f 1f 00                nopl   (%rax)
        1d:   0f 91 c0                setno  %al
        20:   c3                      ret
        21:   cc                      int3
        22:   0f 1f 00                nopl   (%rax)
        25:   0f 92 c0                setb   %al
        28:   c3                      ret
        29:   cc                      int3
      
      and this explodes like this:
      
        int3: 0000 [#1] PREEMPT SMP PTI
        CPU: 0 PID: 2435 Comm: qemu-system-x86 Not tainted 5.17.0-rc8-sls #1
        Hardware name: Dell Inc. Precision WorkStation T3400  /0TP412, BIOS A14 04/30/2012
        RIP: 0010:setc+0x5/0x8 [kvm]
        Code: 00 00 0f 1f 00 0f b6 05 43 24 06 00 c3 cc 0f 1f 80 00 00 00 00 0f 90 c0 c3 cc 0f \
      	  1f 00 0f 91 c0 c3 cc 0f 1f 00 0f 92 c0 c3 cc <0f> 1f 00 0f 93 c0 c3 cc 0f 1f 00 \
      	  0f 94 c0 c3 cc 0f 1f 00 0f 95 c0
        Call Trace:
         <TASK>
         ? x86_emulate_insn [kvm]
         ? x86_emulate_instruction [kvm]
         ? vmx_handle_exit [kvm_intel]
         ? kvm_arch_vcpu_ioctl_run [kvm]
         ? kvm_vcpu_ioctl [kvm]
         ? __x64_sys_ioctl
         ? do_syscall_64
         ? entry_SYSCALL_64_after_hwframe
         </TASK>
      
      Raise the alignment value when SLS is enabled and use a macro for that
      instead of hard-coding naked numbers.
      
      Fixes: e463a09a
      
       ("x86: Add straight-line-speculation mitigation")
      Reported-by: default avatarJamie Heilman <jamie@audible.transient.net>
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Tested-by: default avatarJamie Heilman <jamie@audible.transient.net>
      Link: https://lore.kernel.org/r/YjGzJwjrvxg5YZ0Z@audible.transient.net
      
      
      [Add a comment and a bit of safety checking, since this is going to be changed
       again for IBT support. - Paolo]
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      fe83f5ea