Received-SPF: pass (google.com: domain of linux-kernel+bounces-188891-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Fri, 24 May 2024 08:42:26 -0700
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
To: Alexandre Chartre <alexandre.chartre@oracle.com>
Cc: x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
	daniel.sneddon@linux.intel.com, tglx@linutronix.de,
	konrad.wilk@oracle.com, peterz@infradead.org, seanjc@google.com,
	andrew.cooper3@citrix.com, dave.hansen@linux.intel.com,
	nik.borisov@suse.com, kpsingh@kernel.org, longman@redhat.com,
	bp@alien8.de, pbonzini@redhat.com
Subject: Re: [PATCH v2] x86/bhi: BHI mitigation can trigger warning in #DB
 handler
Message-ID: <20240524154226.dpwoqjuxhzc47ntk@desk>
References: <20240524070459.3674025-1-alexandre.chartre@oracle.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240524070459.3674025-1-alexandre.chartre@oracle.com>

On Fri, May 24, 2024 at 09:04:59AM +0200, Alexandre Chartre wrote:
> When BHI mitigation is enabled, if sysenter is invoked with the TF flag
> set then entry_SYSENTER_compat uses CLEAR_BRANCH_HISTORY and calls the
> clear_bhb_loop() before the TF flag is cleared. This causes the #DB
> handler (exc_debug_kernel) to issue a warning because single-step is
> used outside the entry_SYSENTER_compat function.
> 
> To address this issue, entry_SYSENTER_compat() should use
> CLEAR_BRANCH_HISTORY after making sure flag the TF flag is cleared.
> 
> The problem can be reproduced with the following sequence:
> 
>  $ cat sysenter_step.c
>  int main()
>  { asm("pushf; pop %ax; bts $8,%ax; push %ax; popf; sysenter"); }
> 
>  $ gcc -o sysenter_step sysenter_step.c
> 
>  $ ./sysenter_step
>  Segmentation fault (core dumped)
> 
> The program is expected to crash, and the #DB handler will issue a warning.
> 
> Kernel log:
> 
>   WARNING: CPU: 27 PID: 7000 at arch/x86/kernel/traps.c:1009 exc_debug_kernel+0xd2/0x160
>   ...
>   RIP: 0010:exc_debug_kernel+0xd2/0x160
>   ...
>   Call Trace:
>   <#DB>
>    ? show_regs+0x68/0x80
>    ? __warn+0x8c/0x140
>    ? exc_debug_kernel+0xd2/0x160
>    ? report_bug+0x175/0x1a0
>    ? handle_bug+0x44/0x90
>    ? exc_invalid_op+0x1c/0x70
>    ? asm_exc_invalid_op+0x1f/0x30
>    ? exc_debug_kernel+0xd2/0x160
>    exc_debug+0x43/0x50
>    asm_exc_debug+0x1e/0x40
>   RIP: 0010:clear_bhb_loop+0x0/0xb0
>   ...
>   </#DB>
>   <TASK>
>    ? entry_SYSENTER_compat_after_hwframe+0x6e/0x8d
>   </TASK>
> 
> Fixes: 7390db8aea0d ("x86/bhi: Add support for clearing branch history at syscall entry")
> Reported-by: Suman Maity <suman.m.maity@oracle.com>
> Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>

Reviewed-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>