Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:
 "This tree includes:

   - an FPU related crash fix

   - a ptrace fix (with matching testcase in tools/testing/selftests/)

   - an x86 Kconfig DMA-config defaults tweak to better avoid
     non-working drivers"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  config: Enable NEED_DMA_MAP_STATE by default when SWIOTLB is selected
  x86/fpu: Load xsave pointer *after* initialization
  x86/ptrace: Fix the TIF_FORCED_TF logic in handle_signal()
  x86, selftests: Add single_step_syscall test

6 files changed, 202 insertions, 15 deletions

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index d43e7e1c784b..937812b8e0b9 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -178,7 +178,7 @@ config SBUS
 
 config NEED_DMA_MAP_STATE
         def_bool y
-        depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG
+        depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB
 
 config NEED_SG_DMA_LENGTH
         def_bool y
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index 367f39d35e9c..009183276bb7 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -341,7 +341,7 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset,
                 unsigned int pos, unsigned int count,
                 void *kbuf, void __user *ubuf)
 {
-        struct xsave_struct *xsave = &target->thread.fpu.state->xsave;
+        struct xsave_struct *xsave;
         int ret;
 
         if (!cpu_has_xsave)
@@ -351,6 +351,8 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset,
         if (ret)
                 return ret;
 
+        xsave = &target->thread.fpu.state->xsave;
+
         /*
          * Copy the 48bytes defined by the software first into the xstate
          * memory layout in the thread struct, so that we can copy the entire
@@ -369,7 +371,7 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset,
                   unsigned int pos, unsigned int count,
                   const void *kbuf, const void __user *ubuf)
 {
-        struct xsave_struct *xsave = &target->thread.fpu.state->xsave;
+        struct xsave_struct *xsave;
         int ret;
 
         if (!cpu_has_xsave)
@@ -379,6 +381,8 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset,
         if (ret)
                 return ret;
 
+        xsave = &target->thread.fpu.state->xsave;
+
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, xsave, 0, -1);
         /*
          * mxcsr reserved bits must be masked to zero for security reasons.
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index f9804080ccb3..1ea14fd53933 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -616,7 +616,8 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
 static void
 handle_signal(struct ksignal *ksig, struct pt_regs *regs)
 {
-        bool failed;
+        bool stepping, failed;
+
         /* Are we from a system call? */
         if (syscall_get_nr(current, regs) >= 0) {
                 /* If so, check system call restarting.. */
@@ -640,12 +641,13 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
         }
 
         /*
-         * If TF is set due to a debugger (TIF_FORCED_TF), clear the TF
-         * flag so that register information in the sigcontext is correct.
+         * If TF is set due to a debugger (TIF_FORCED_TF), clear TF now
+         * so that register information in the sigcontext is correct and
+         * then notify the tracer before entering the signal handler.
          */
-        if (unlikely(regs->flags & X86_EFLAGS_TF) &&
-            likely(test_and_clear_thread_flag(TIF_FORCED_TF)))
-                regs->flags &= ~X86_EFLAGS_TF;
+        stepping = test_thread_flag(TIF_SINGLESTEP);
+        if (stepping)
+                user_disable_single_step(current);
 
         failed = (setup_rt_frame(ksig, regs) < 0);
         if (!failed) {
@@ -656,10 +658,8 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
                  * it might disable possible debug exception from the
                  * signal handler.
                  *
-                 * Clear TF when entering the signal handler, but
-                 * notify any tracer that was single-stepping it.
-                 * The tracer may want to single-step inside the
-                 * handler too.
+                 * Clear TF for the case when it wasn't set by debugger to
+                 * avoid the recursive send_sigtrap() in SIGTRAP handler.
                  */
                 regs->flags &= ~(X86_EFLAGS_DF|X86_EFLAGS_RF|X86_EFLAGS_TF);
                 /*
@@ -668,7 +668,7 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
                 if (used_math())
                         fpu_reset_state(current);
         }
-        signal_setup_done(failed, ksig, test_thread_flag(TIF_SINGLESTEP));
+        signal_setup_done(failed, ksig, stepping);
 }
 
 #ifdef CONFIG_X86_32
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index f0a7918178dd..ddf63569df5a 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -1,6 +1,6 @@
 .PHONY: all all_32 all_64 check_build32 clean run_tests
 
-TARGETS_C_BOTHBITS := sigreturn
+TARGETS_C_BOTHBITS := sigreturn single_step_syscall
 
 BINARIES_32 := $(TARGETS_C_BOTHBITS:%=%_32)
 BINARIES_64 := $(TARGETS_C_BOTHBITS:%=%_64)
diff --git a/tools/testing/selftests/x86/run_x86_tests.sh b/tools/testing/selftests/x86/run_x86_tests.sh
index 3d3ec65f3e7c..3fc19b376812 100644
--- a/tools/testing/selftests/x86/run_x86_tests.sh
+++ b/tools/testing/selftests/x86/run_x86_tests.sh
@@ -3,9 +3,11 @@
 # This is deliberately minimal.  IMO kselftests should provide a standard
 # script here.
 ./sigreturn_32 || exit 1
+./single_step_syscall_32 || exit 1
 
 if [[ "$uname -p" -eq "x86_64" ]]; then
     ./sigreturn_64 || exit 1
+    ./single_step_syscall_64 || exit 1
 fi
 
 exit 0
diff --git a/tools/testing/selftests/x86/single_step_syscall.c b/tools/testing/selftests/x86/single_step_syscall.c
new file mode 100644
index 000000000000..50c26358e8b7
--- /dev/null
+++ b/tools/testing/selftests/x86/single_step_syscall.c
@@ -0,0 +1,181 @@
+/*
+ * single_step_syscall.c - single-steps various x86 syscalls
+ * Copyright (c) 2014-2015 Andrew Lutomirski
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * This is a very simple series of tests that makes system calls with
+ * the TF flag set.  This exercises some nasty kernel code in the
+ * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set
+ * immediately issues #DB from CPL 0.  This requires special handling in
+ * the kernel.
+ */
+
+#define _GNU_SOURCE
+
+#include <sys/time.h>
+#include <time.h>
+#include <stdlib.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+#include <sys/mman.h>
+#include <sys/signal.h>
+#include <sys/ucontext.h>
+#include <asm/ldt.h>
+#include <err.h>
+#include <setjmp.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <sys/ptrace.h>
+#include <sys/user.h>
+
+static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
+                       int flags)
+{
+        struct sigaction sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sa_sigaction = handler;
+        sa.sa_flags = SA_SIGINFO | flags;
+        sigemptyset(&sa.sa_mask);
+        if (sigaction(sig, &sa, 0))
+                err(1, "sigaction");
+}
+
+static volatile sig_atomic_t sig_traps;
+
+#ifdef __x86_64__
+# define REG_IP REG_RIP
+# define WIDTH "q"
+#else
+# define REG_IP REG_EIP
+# define WIDTH "l"
+#endif
+
+static unsigned long get_eflags(void)
+{
+        unsigned long eflags;
+        asm volatile ("pushf" WIDTH "\n\tpop" WIDTH " %0" : "=rm" (eflags));
+        return eflags;
+}
+
+static void set_eflags(unsigned long eflags)
+{
+        asm volatile ("push" WIDTH " %0\n\tpopf" WIDTH
+                      : : "rm" (eflags) : "flags");
+}
+
+#define X86_EFLAGS_TF (1UL << 8)
+
+static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
+{
+        ucontext_t *ctx = (ucontext_t*)ctx_void;
+
+        if (get_eflags() & X86_EFLAGS_TF) {
+                set_eflags(get_eflags() & ~X86_EFLAGS_TF);
+                printf("[WARN]\tSIGTRAP handler had TF set\n");
+                _exit(1);
+        }
+
+        sig_traps++;
+
+        if (sig_traps == 10000 || sig_traps == 10001) {
+                printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",
+                       (int)sig_traps,
+                       (unsigned long)info->si_addr,
+                       (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
+        }
+}
+
+static void check_result(void)
+{
+        unsigned long new_eflags = get_eflags();
+        set_eflags(new_eflags & ~X86_EFLAGS_TF);
+
+        if (!sig_traps) {
+                printf("[FAIL]\tNo SIGTRAP\n");
+                exit(1);
+        }
+
+        if (!(new_eflags & X86_EFLAGS_TF)) {
+                printf("[FAIL]\tTF was cleared\n");
+                exit(1);
+        }
+
+        printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps);
+        sig_traps = 0;
+}
+
+int main()
+{
+        int tmp;
+
+        sethandler(SIGTRAP, sigtrap, 0);
+
+        printf("[RUN]\tSet TF and check nop\n");
+        set_eflags(get_eflags() | X86_EFLAGS_TF);
+        asm volatile ("nop");
+        check_result();
+
+#ifdef __x86_64__
+        printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");
+        set_eflags(get_eflags() | X86_EFLAGS_TF);
+        extern unsigned char post_nop[];
+        asm volatile ("pushf" WIDTH "\n\t"
+                      "pop" WIDTH " %%r11\n\t"
+                      "nop\n\t"
+                      "post_nop:"
+                      : : "c" (post_nop) : "r11");
+        check_result();
+#endif
+
+        printf("[RUN]\tSet TF and check int80\n");
+        set_eflags(get_eflags() | X86_EFLAGS_TF);
+        asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid));
+        check_result();
+
+        /*
+         * This test is particularly interesting if fast syscalls use
+         * SYSENTER: it triggers a nasty design flaw in SYSENTER.
+         * Specifically, SYSENTER does not clear TF, so either SYSENTER
+         * or the next instruction traps at CPL0.  (Of course, Intel
+         * mostly forgot to document exactly what happens here.)  So we
+         * get a CPL0 fault with usergs (on 64-bit kernels) and possibly
+         * no stack.  The only sane way the kernel can possibly handle
+         * it is to clear TF on return from the #DB handler, but this
+         * happens way too early to set TF in the saved pt_regs, so the
+         * kernel has to do something clever to avoid losing track of
+         * the TF bit.
+         *
+         * Needless to say, we've had bugs in this area.
+         */
+        syscall(SYS_getpid);  /* Force symbol binding without TF set. */
+        printf("[RUN]\tSet TF and check a fast syscall\n");
+        set_eflags(get_eflags() | X86_EFLAGS_TF);
+        syscall(SYS_getpid);
+        check_result();
+
+        /* Now make sure that another fast syscall doesn't set TF again. */
+        printf("[RUN]\tFast syscall with TF cleared\n");
+        fflush(stdout);  /* Force a syscall */
+        if (get_eflags() & X86_EFLAGS_TF) {
+                printf("[FAIL]\tTF is now set\n");
+                exit(1);
+        }
+        if (sig_traps) {
+                printf("[FAIL]\tGot SIGTRAP\n");
+                exit(1);
+        }
+        printf("[OK]\tNothing unexpected happened\n");
+
+        return 0;
+}