linux-toradex.git/arch/x86_64, branch v2.6.16.42

x86_64: Don't leak NT bit into next task (CVE-2006-5755)

2007-01-09T02:23:30+00:00

SYSENTER can cause a NT to be set which might cause crashes on the IRET
in the next task.

Following similar i386 patch from Linus.

Backport to 2.6.16 by Chuck Ebbert <76306.1226@compuserve.com>
[Changed 'set_debugreg' to the older 'set_debug' in setup64.c
and added raw_local_save_flags() from 2.6.19 to system.h]

Signed-off-by: Andi Kleen 
Signed-off-by: Adrian Bunk

x86-64: Mark rdtsc as sync only for netburst, not for core2

2006-12-17T20:49:57+00:00

On the Core2 cpus, the rdtsc instruction is not serializing (as defined
in the architecture reference since rdtsc exists) and due to the deep
speculation of these cores, it's possible that you can observe time go
backwards between cores due to this speculation. Since the kernel
already deals with this with the SYNC_RDTSC flag, the solution is
simple, only assume that the instruction is serializing on family 15...

The price one pays for this is a slightly slower gettimeofday (by a
dozen or two cycles), but that increase is quite small to pay for a
really-going-forward tsc counter.

Backport by Chris Wright.

Signed-off-by: Arjan van de Ven 
Signed-off-by: Chris Wright 
Signed-off-by: Adrian Bunk

ACPI: enable SMP C-states on x86_64

2006-11-05T07:23:24+00:00

http://bugzilla.kernel.org/show_bug.cgi?id=5653

Signed-off-by: Shaohua Li 
Signed-off-by: Len Brown 
Signed-off-by: Adrian Bunk

memory hotplug: solve config broken: undefined reference to `online_page'

2006-08-08T15:35:33+00:00

Memory hotplug code of i386 adds memory to only highmem.  So, if
CONFIG_HIGHMEM is not set, CONFIG_MEMORY_HOTPLUG shouldn't be set.
Otherwise, it causes compile error.

In addition, many architecture can't use memory hotplug feature yet.  So, I
introduce CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG.

Signed-off-by: Yasunori Goto 
Signed-off-by: Adrian Bunk

[PATCH] x86_64: Don't do syscall exit tracing twice

2006-06-05T17:18:14+00:00

This fixes a regression from the earlier DOS fix for non canonical
IRET addresses. It broke UML.

int_ret_from_syscall already does syscall exit tracing, so
no need to do it again in the caller.

This caused problems for UML and some other special programs doing
syscall interception.

Signed-off-by: Andi Kleen 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] x86_64: x86_64 add crashdump trigger points

2006-06-05T17:18:14+00:00

o Start booting into the capture kernel after an Oops if system is in a
  unrecoverable state. System will boot into the capture kernel, if one is
  pre-loaded by the user, and capture the kernel core dump.

o One of the following conditions should be true to trigger the booting of
  capture kernel.
        - panic_on_oops is set.
        - pid of current thread is 0
        - pid of current thread is 1
        - Oops happened inside interrupt context.

Signed-off-by: Vivek Goyal 
Signed-off-by: Andi Kleen 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Chris Wright

[PATCH] x86_64: Fix a race in the free_iommu path.

2006-05-01T19:03:42+00:00

We do this by removing a micro-optimization that tries to avoid grabbing
the iommu_bitmap_lock spinlock and using a bus-locked operation.

This still races with other simultaneous alloc_iommu or free_iommu(size
> 1) which both use bus-unlocked operations.

The end result of this race is eventually ending
up with an iommu_gart_bitmap that has bits errornously set all over,
making large contiguous iommu space allocations fail with 'PCI-DMA:
Out of IOMMU space'.

Signed-off-by: Mike Waychison 
Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman

[PATCH] x86_64: Pass -32 to the assembler when compiling the 32bit vsyscall pages

2006-05-01T19:03:42+00:00

This quietens warnings and actually fixes a bug. The unwind tables would
come out wrong without -32, causing pthread cancellation during them
to crash in the gcc runtime.

The problem seems to only happen with newer binutils
(it doesn't happen with 2.16.91.0.2 but happens wit 2.16.91.0.5)

Thanks to Brian Baker @ HP for test case and initial analysis.

Cc: brian.b@hp.com

Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman

[PATCH] i386/x86-64: Fix x87 information leak between processes (CVE-2006-1056)

2006-04-19T05:54:44+00:00

AMD K7/K8 CPUs only save/restore the FOP/FIP/FDP x87 registers in FXSAVE
when an exception is pending.  This means the value leak through context
switches and allow processes to observe some x87 instruction state of
other processes.

This was actually documented by AMD, but nobody recognized it as being
different from Intel before.

The fix first adds an optimization: instead of unconditionally calling
FNCLEX after each FXSAVE test if ES is pending and skip it when not
needed. Then do a x87 load from a kernel variable to clear FOP/FIP/FDP.

This means other processes always will only see a constant value defined
by the kernel in their FP state.

I took some pain to make sure to chose a variable that's already in L1
during context switch to make the overhead of this low.

Also alternative() is used to patch away the new code on CPUs who don't
need it.

Patch for both i386/x86-64.

The problem was discovered originally by Jan Beulich. Richard Brunner
provided the basic code for the workarounds, with contribution from Jan.

This is CVE-2006-1056

Cc: richard.brunner@amd.com
Cc: jbeulich@novell.com
Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman

[PATCH] x86_64: When user could have changed RIP always force IRET (CVE-2006-0744)

2006-04-12T20:06:54+00:00

Intel EM64T CPUs handle uncanonical return addresses differently from
AMD CPUs.

The exception is reported in the SYSRET, not the next instruction.
Thgis leads to the kernel exception handler running on the user stack
with the wrong GS because the kernel didn't expect exceptions on this
instruction.

This version of the patch has the teething problems that plagued an
earlier version fixed.

This is CVE-2006-0744

Thanks to Ernie Petrides and Asit B. Mallick for analysis and initial
patches.

Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman