Hello,
kernel test robot noticed "WARNING:at_arch/x86/kernel/alternative.c:#apply_returns" on:
commit: 4535e1a4174c4111d92c5a9a21e542d232e0fcaa ("x86/bugs: Fix the SRSO mitigation on Zen3/4")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
[test failed (WARNING still exists) on linus/master 026e680b0a08a62b1d948e5a8ca78700bfac0e6e]
in testcase: boot
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+-------------------------------------------------------------+------------+------------+
| | 091619baac | 4535e1a417 |
+-------------------------------------------------------------+------------+------------+
| WARNING:at_arch/x86/kernel/alternative.c:#apply_returns | 0 | 26 |
| RIP:apply_returns | 0 | 26 |
+-------------------------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-lkp/[email protected]
[ 4.454924][ T0] ------------[ cut here ]------------
[ 4.455865][ T0] missing return thunk: srso_alias_untrain_ret+0x0/0x10-0x0: eb 0e 66 66 2e
[ 4.455900][ T0] WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:826 apply_returns (arch/x86/kernel/alternative.c:826 (discriminator 3))
[ 4.459866][ T0] Modules linked in:
[ 4.460995][ T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.9.0-rc1-00206-g4535e1a4174c #1
[ 4.463858][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 4.466087][ T0] RIP: 0010:apply_returns (arch/x86/kernel/alternative.c:826 (discriminator 3))
[ 4.467863][ T0] Code: 6c 08 00 0f 85 55 ff ff ff 49 89 e8 b9 05 00 00 00 4c 89 fa 48 89 ee 48 c7 c7 40 16 21 86 c6 05 70 35 6c 08 01 e8 b9 67 13 00 <0f> 0b e9 2d ff ff ff 48 89 ee 48 c7 c7 c0 15 21 86 89 54 24 20 e8
All code
========
0: 6c insb (%dx),%es:(%rdi)
1: 08 00 or %al,(%rax)
3: 0f 85 55 ff ff ff jne 0xffffffffffffff5e
9: 49 89 e8 mov %rbp,%r8
c: b9 05 00 00 00 mov $0x5,%ecx
11: 4c 89 fa mov %r15,%rdx
14: 48 89 ee mov %rbp,%rsi
17: 48 c7 c7 40 16 21 86 mov $0xffffffff86211640,%rdi
1e: c6 05 70 35 6c 08 01 movb $0x1,0x86c3570(%rip) # 0x86c3595
25: e8 b9 67 13 00 call 0x1367e3
2a:* 0f 0b ud2 <-- trapping instruction
2c: e9 2d ff ff ff jmp 0xffffffffffffff5e
31: 48 89 ee mov %rbp,%rsi
34: 48 c7 c7 c0 15 21 86 mov $0xffffffff862115c0,%rdi
3b: 89 54 24 20 mov %edx,0x20(%rsp)
3f: e8 .byte 0xe8
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: e9 2d ff ff ff jmp 0xffffffffffffff34
7: 48 89 ee mov %rbp,%rsi
a: 48 c7 c7 c0 15 21 86 mov $0xffffffff862115c0,%rdi
11: 89 54 24 20 mov %edx,0x20(%rsp)
15: e8 .byte 0xe8
[ 4.471957][ T0] RSP: 0000:ffffffff87c07da8 EFLAGS: 00010286
[ 4.473322][ T0] RAX: dffffc0000000000 RBX: ffffffff8a7dd3d4 RCX: 1ffffffff0f99780
[ 4.475864][ T0] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87ccbc00
[ 4.477470][ T0] RBP: ffffffff85f20ec0 R08: ffffffff813065f6 R09: fffffbfff0f99780
[ 4.479864][ T0] R10: ffffffff87ccbc03 R11: 0000000000000001 R12: ffffffff87c07e18
[ 4.483858][ T0] R13: ffffffff87c07e38 R14: dffffc0000000000 R15: 0000000000000000
[ 4.485336][ T0] FS: 0000000000000000(0000) GS:ffff8883ae800000(0000) knlGS:0000000000000000
[ 4.487866][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4.489476][ T0] CR2: ffff88843ffff000 CR3: 0000000007c2c000 CR4: 00000000000406b0
[ 4.491094][ T0] Call Trace:
[ 4.491866][ T0] <TASK>
[ 4.492462][ T0] ? __warn (kernel/panic.c:694)
[ 4.493552][ T0] ? apply_returns (arch/x86/kernel/alternative.c:826 (discriminator 3))
[ 4.494545][ T0] ? report_bug (lib/bug.c:180 lib/bug.c:219)
[ 4.495483][ T0] ? handle_bug (arch/x86/kernel/traps.c:239)
[ 4.495865][ T0] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1))
[ 4.496810][ T0] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621)
[ 4.497820][ T0] ? __x86_indirect_thunk_r15 (arch/x86/lib/retpoline.S:231)
[ 4.499863][ T0] ? this_cpu_in_panic (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/atomic/atomic-instrumented.h:33 kernel/printk/printk.c:359)
[ 4.500846][ T0] ? apply_returns (arch/x86/kernel/alternative.c:826 (discriminator 3))
[ 4.501836][ T0] ? apply_returns (arch/x86/kernel/alternative.c:826 (discriminator 3))
[ 4.502811][ T0] ? reacquire_held_locks (kernel/locking/lockdep.c:5405)
[ 4.503861][ T0] ? lock_sync (kernel/locking/lockdep.c:5722)
[ 4.504758][ T0] ? apply_retpolines (arch/x86/kernel/alternative.c:804)
[ 4.506093][ T0] ? unregister_die_notifier (kernel/notifier.c:203 kernel/notifier.c:608)
[ 4.507869][ T0] ? __x86_indirect_thunk_r15 (arch/x86/lib/retpoline.S:231)
[ 4.509312][ T0] ? srso_alias_untrain_ret (arch/x86/lib/retpoline.S:231)
[ 4.510384][ T0] ? srso_alias_untrain_ret (arch/x86/lib/retpoline.S:231)
[ 4.511446][ T0] ? int3_selftest_ip (arch/x86/kernel/alternative.c:1610 (discriminator 2))
[ 4.511865][ T0] ? debug_alt (arch/x86/kernel/alternative.c:1610)
[ 4.513050][ T0] alternative_instructions (arch/x86/kernel/alternative.c:1705)
[ 4.514165][ T0] arch_cpu_finalize_init (arch/x86/kernel/cpu/common.c:2368)
[ 4.515869][ T0] start_kernel (init/main.c:1042)
[ 4.517000][ T0] x86_64_start_reservations (arch/x86/kernel/head64.c:495)
[ 4.518085][ T0] x86_64_start_kernel (??:?)
[ 4.520060][ T0] common_startup_64 (arch/x86/kernel/head_64.S:421)
[ 4.521097][ T0] </TASK>
[ 4.521858][ T0] irq event stamp: 197308
[ 4.522913][ T0] hardirqs last enabled at (197316): console_unlock (arch/x86/include/asm/irqflags.h:26 arch/x86/include/asm/irqflags.h:67 arch/x86/include/asm/irqflags.h:127 kernel/printk/printk.c:341 kernel/printk/printk.c:2731 kernel/printk/printk.c:3050)
[ 4.523863][ T0] hardirqs last disabled at (197333): console_unlock (kernel/printk/printk.c:339 kernel/printk/printk.c:2731 kernel/printk/printk.c:3050)
[ 4.525769][ T0] softirqs last enabled at (197331): __do_softirq (arch/x86/include/asm/preempt.h:26 kernel/softirq.c:401 kernel/softirq.c:583)
[ 4.527861][ T0] softirqs last disabled at (197350): irq_exit_rcu (kernel/softirq.c:428 kernel/softirq.c:633 kernel/softirq.c:645)
[ 4.531857][ T0] ---[ end trace 0000000000000000 ]---
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240402/[email protected]
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
On Tue, Apr 02, 2024 at 10:14:07AM +0800, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "WARNING:at_arch/x86/kernel/alternative.c:#apply_returns" on:
>
> commit: 4535e1a4174c4111d92c5a9a21e542d232e0fcaa ("x86/bugs: Fix the SRSO mitigation on Zen3/4")
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
---
From: "Borislav Petkov (AMD)" <[email protected]>
Date: Tue, 2 Apr 2024 16:05:49 +0200
Subject: [PATCH] x86/retpoline: Fix a missing return thunk warning
The srso_alias_untrain_ret() dummy thunk in the !CONFIG_MITIGATION_SRSO
case is there only for the altenative in CALL_UNTRAIN_RET to have
a symbol to resolve.
However, testing with kernels which don't have CONFIG_MITIGATION_SRSO
enabled, leads to the warning in patch_return() to fire:
missing return thunk: srso_alias_untrain_ret+0x0/0x10-0x0: eb 0e 66 66 2e
WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:826 apply_returns (arch/x86/kernel/alternative.c:826
Put in a plain "ret" there so that gcc doesn't put a return thunk in
in its place which special and gets checked.
Reported-by: kernel test robot <[email protected]>
Closes: https://lore.kernel.org/oe-lkp/[email protected]
Signed-off-by: Borislav Petkov (AMD) <[email protected]>
Link: https://lore.kernel.org/all/[email protected]/
---
arch/x86/lib/retpoline.S | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
index 02cde194a99e..440cc58986fa 100644
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -228,7 +228,9 @@ SYM_CODE_END(srso_return_thunk)
#else /* !CONFIG_MITIGATION_SRSO */
/* Dummy for the alternative in CALL_UNTRAIN_RET. */
SYM_CODE_START(srso_alias_untrain_ret)
- RET
+ ANNOTATE_UNRET_SAFE
+ ret
+ int3
SYM_FUNC_END(srso_alias_untrain_ret)
#define JMP_SRSO_UNTRAIN_RET "ud2"
#endif /* CONFIG_MITIGATION_SRSO */
--
2.43.0
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
On Wed, 3 Apr 2024 at 05:24, Borislav Petkov <[email protected]> wrote:
>
> Subject: [PATCH] x86/retpoline: Fix a missing return thunk warning
Thanks, applied directly,
Linus
On Wed, Apr 03, 2024 at 09:45:25AM -0700, Linus Torvalds wrote:
> On Wed, 3 Apr 2024 at 05:24, Borislav Petkov <[email protected]> wrote:
> >
> > Subject: [PATCH] x86/retpoline: Fix a missing return thunk warning
>
> Thanks, applied directly,
Can you pls replace it with the below one?
There's more breakage:
https://bugzilla.kernel.org/show_bug.cgi?id=218679
and I think it needs an __EXPORT_THUNK too.
Yeah, I know. Damn ifdeffery. :-\
I've changed it:
https://bugzilla.kernel.org/attachment.cgi?id=306084&action=diff
and this should be the correct fix(tm). Famous last words.
Thx.
---
From ca5b34498f997cba9c24d450f7ccab4b37377560 Mon Sep 17 00:00:00 2001
From: "Borislav Petkov (AMD)" <[email protected]>
Date: Tue, 2 Apr 2024 16:05:49 +0200
Subject: [PATCH] x86/retpoline: Do the necessary fixup to the Zen3/4 srso
return thunk for !SRSO
The srso_alias_untrain_ret() dummy thunk in the !CONFIG_MITIGATION_SRSO
case is there only for the altenative in CALL_UNTRAIN_RET to have
a symbol to resolve.
However, testing with kernels which don't have CONFIG_MITIGATION_SRSO
enabled, leads to the warning in patch_return() to fire:
missing return thunk: srso_alias_untrain_ret+0x0/0x10-0x0: eb 0e 66 66 2e
WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:826 apply_returns (arch/x86/kernel/alternative.c:826
Put in a plain "ret" there so that gcc doesn't put a return thunk in
in its place which special and gets checked.
In addition:
ERROR: modpost: "srso_alias_untrain_ret" [arch/x86/kvm/kvm-amd.ko] undefined!
make[2]: *** [scripts/Makefile.modpost:145: Module.symvers] Chyba 1
make[1]: *** [/usr/src/linux-6.8.3/Makefile:1873: modpost] Chyba 2
make: *** [Makefile:240: __sub-make] Chyba 2
since !SRSO builds would use the dummy return thunk as reported by
[email protected], https://bugzilla.kernel.org/show_bug.cgi?id=218679.
Reported-by: kernel test robot <[email protected]>
Closes: https://lore.kernel.org/oe-lkp/[email protected]
Signed-off-by: Borislav Petkov (AMD) <[email protected]>
Link: https://lore.kernel.org/all/[email protected]/
---
arch/x86/lib/retpoline.S | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
index 02cde194a99e..0795b3464058 100644
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -228,8 +228,11 @@ SYM_CODE_END(srso_return_thunk)
#else /* !CONFIG_MITIGATION_SRSO */
/* Dummy for the alternative in CALL_UNTRAIN_RET. */
SYM_CODE_START(srso_alias_untrain_ret)
- RET
+ ANNOTATE_UNRET_SAFE
+ ret
+ int3
SYM_FUNC_END(srso_alias_untrain_ret)
+__EXPORT_THUNK(srso_alias_untrain_ret)
#define JMP_SRSO_UNTRAIN_RET "ud2"
#endif /* CONFIG_MITIGATION_SRSO */
--
2.43.0
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
On Wed, 3 Apr 2024 at 10:05, Borislav Petkov <[email protected]> wrote:
>
> Can you pls replace it with the below one?
Ok, done.
Linus