Patch "x86/bhi: Avoid warning in #DB handler due to BHI mitigation" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    x86/bhi: Avoid warning in #DB handler due to BHI mitigation

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     x86-bhi-avoid-warning-in-db-handler-due-to-bhi-mitig.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fec0a9fe8c4ccac8e2018aee91c2da8b85647313
Author: Alexandre Chartre <alexandre.chartre@xxxxxxxxxx>
Date:   Fri May 24 09:04:59 2024 +0200

    x86/bhi: Avoid warning in #DB handler due to BHI mitigation
    
    [ Upstream commit ac8b270b61d48fcc61f052097777e3b5e11591e0 ]
    
    When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set
    then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY and calls the
    clear_bhb_loop() before the TF flag is cleared. This causes the #DB handler
    (exc_debug_kernel()) to issue a warning because single-step is used outside the
    entry_SYSENTER_compat() function.
    
    To address this issue, entry_SYSENTER_compat() should use CLEAR_BRANCH_HISTORY
    after making sure the TF flag is cleared.
    
    The problem can be reproduced with the following sequence:
    
      $ cat sysenter_step.c
      int main()
      { asm("pushf; pop %ax; bts $8,%ax; push %ax; popf; sysenter"); }
    
      $ gcc -o sysenter_step sysenter_step.c
    
      $ ./sysenter_step
      Segmentation fault (core dumped)
    
    The program is expected to crash, and the #DB handler will issue a warning.
    
    Kernel log:
    
      WARNING: CPU: 27 PID: 7000 at arch/x86/kernel/traps.c:1009 exc_debug_kernel+0xd2/0x160
      ...
      RIP: 0010:exc_debug_kernel+0xd2/0x160
      ...
      Call Trace:
      <#DB>
       ? show_regs+0x68/0x80
       ? __warn+0x8c/0x140
       ? exc_debug_kernel+0xd2/0x160
       ? report_bug+0x175/0x1a0
       ? handle_bug+0x44/0x90
       ? exc_invalid_op+0x1c/0x70
       ? asm_exc_invalid_op+0x1f/0x30
       ? exc_debug_kernel+0xd2/0x160
       exc_debug+0x43/0x50
       asm_exc_debug+0x1e/0x40
      RIP: 0010:clear_bhb_loop+0x0/0xb0
      ...
      </#DB>
      <TASK>
       ? entry_SYSENTER_compat_after_hwframe+0x6e/0x8d
      </TASK>
    
      [ bp: Massage commit message. ]
    
    Fixes: 7390db8aea0d ("x86/bhi: Add support for clearing branch history at syscall entry")
    Reported-by: Suman Maity <suman.m.maity@xxxxxxxxxx>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@xxxxxxxxxx>
    Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Pawan Gupta <pawan.kumar.gupta@xxxxxxxxxxxxxxx>
    Reviewed-by: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240524070459.3674025-1-alexandre.chartre@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index b14b8cd85eb23..74a2f418e6745 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -90,10 +90,6 @@ SYM_INNER_LABEL(entry_SYSENTER_compat_after_hwframe, SYM_L_GLOBAL)
 
 	cld
 
-	IBRS_ENTER
-	UNTRAIN_RET
-	CLEAR_BRANCH_HISTORY
-
 	/*
 	 * SYSENTER doesn't filter flags, so we need to clear NT and AC
 	 * ourselves.  To save a few cycles, we can check whether
@@ -117,6 +113,16 @@ SYM_INNER_LABEL(entry_SYSENTER_compat_after_hwframe, SYM_L_GLOBAL)
 	jnz	.Lsysenter_fix_flags
 .Lsysenter_flags_fixed:
 
+	/*
+	 * CPU bugs mitigations mechanisms can call other functions. They
+	 * should be invoked after making sure TF is cleared because
+	 * single-step is ignored only for instructions inside the
+	 * entry_SYSENTER_compat function.
+	 */
+	IBRS_ENTER
+	UNTRAIN_RET
+	CLEAR_BRANCH_HISTORY
+
 	movq	%rsp, %rdi
 	call	do_SYSENTER_32
 	/* XEN PV guests always use IRET path */




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux