On Thu, Oct 10, 2024 at 04:57:31PM -0700, Mitchell Levy wrote:
> There are two distinct CPU features related to the use of XSAVES and LBR:
> whether LBR is itself supported and whether XSAVES supports LBR. The LBR
> subsystem correctly checks both in intel_pmu_arch_lbr_init(), but the
> XSTATE subsystem does not.
>
> The LBR bit is only removed from xfeatures_mask_independent when LBR is not
> supported by the CPU, but there is no validation of XSTATE support.
> If XSAVES does not support LBR the write to IA32_XSS causes a #GP fault,
> leaving the state of IA32_XSS unchanged, i.e. zero. The fault is handled
> with a warning and the boot continues.
>
> Consequently the next XRSTORS which tries to restore supervisor state fails
> with #GP because the RFBM has zero for all supervisor features, which does
> not match the XCOMP_BV field.
>
> As XFEATURE_MASK_FPSTATE includes supervisor features setting up the FPU
> causes a #GP, which ends up in fpu_reset_from_exception_fixup(). That fails
> due to the same problem resulting in recursive #GPs until the kernel runs
> out of stack space and double faults.
>
> Prevent this by storing the supported independent features in
> fpu_kernel_cfg during XSTATE initialization and use that cached value for
> retrieving the independent feature bits to be written into IA32_XSS.
>
> [ tglx: Massaged change log ]
>
> Fixes: f0dccc9da4c0 ("x86/fpu/xstate: Support dynamic supervisor feature for LBR")
> Suggested-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> [ Mitchell Levy: Backport to 5.15, since struct fpu_config is not
> introduced until 578971f4e228 and feature masks are not included in
> said struct until 1c253ff2287f ]
> Signed-off-by: Mitchell Levy <levymitchell0@xxxxxxxxx>
> Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Link: https://lore.kernel.org/all/20240812-xsave-lbr-fix-v3-1-95bac1bf62f4@xxxxxxxxx
> ---
> arch/x86/include/asm/fpu/xstate.h | 5 +++--
> arch/x86/kernel/fpu/xstate.c | 7 +++++++
> 2 files changed, 10 insertions(+), 2 deletions(-)
>
<formletter>
This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.
</formletter>
