Merge: x86/bhi: Avoid warning in #DB handler due to BHI mitigation

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/5004

JIRA: https://issues.redhat.com/browse/RHEL-53662    
JIRA: https://issues.redhat.com/browse/RHEL-53665    
CVE: CVE-2024-42240

commit ac8b270    
Author: Alexandre Chartre <alexandre.chartre@oracle.com>    
Date:   Fri, 24 May 2024 09:04:59 +0200

    x86/bhi: Avoid warning in #DB handler due to BHI mitigation

    When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set
    then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY and calls the
    clear_bhb_loop() before the TF flag is cleared. This causes the #DB handler
    (exc_debug_kernel()) to issue a warning because single-step is used outside the
    entry_SYSENTER_compat() function.

    To address this issue, entry_SYSENTER_compat() should use CLEAR_BRANCH_HISTORY
    after making sure the TF flag is cleared.
    The problem can be reproduced with the following sequence:

      $ cat sysenter_step.c
      int main()
      { asm("pushf; pop %ax; bts $8,%ax; push %ax; popf; sysenter"); }

      $ gcc -o sysenter_step sysenter_step.c

      $ ./sysenter_step
      Segmentation fault (core dumped)

    The program is expected to crash, and the #DB handler will issue a warning.

    Kernel log:

      WARNING: CPU: 27 PID: 7000 at arch/x86/kernel/traps.c:1009 exc_debug_kernel+0xd2/0x160
      ...
      RIP: 0010:exc_debug_kernel+0xd2/0x160
      ...
      Call Trace:
      <#DB>
       ? show_regs+0x68/0x80
       ? __warn+0x8c/0x140
       ? exc_debug_kernel+0xd2/0x160
       ? report_bug+0x175/0x1a0
       ? handle_bug+0x44/0x90
       ? exc_invalid_op+0x1c/0x70
       ? asm_exc_invalid_op+0x1f/0x30
       ? exc_debug_kernel+0xd2/0x160
       exc_debug+0x43/0x50
       asm_exc_debug+0x1e/0x40
      RIP: 0010:clear_bhb_loop+0x0/0xb0
      ...
      </#DB>
      <TASK>
       ? entry_SYSENTER_compat_after_hwframe+0x6e/0x8d
      </TASK>

      [ bp: Massage commit message. ]

    Fixes: 7390db8 ("x86/bhi: Add support for clearing branch history at syscall entry")
    Reported-by: Suman Maity <suman.m.maity@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
    Link: https://lore.kernel.org/r/20240524070459.3674025-1-alexandre.chartre@oracle.com

Signed-off-by: Waiman Long <longman@redhat.com>

Approved-by: Lenny Szubowicz <lszubowi@redhat.com>
Approved-by: Rafael Aquini <raquini@redhat.com>
Approved-by: Jay Shin <jaeshin@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Lucas Zampieri <lzampier@redhat.com>

Author: zampierilucas

arch/x86/entry/entry_64_compat.S

@@ -90,10 +90,6 @@ SYM_INNER_LABEL(entry_SYSENTER_compat_after_hwframe, SYM_L_GLOBAL)
 
 	cld
 
-	IBRS_ENTER
-	UNTRAIN_RET
-	CLEAR_BRANCH_HISTORY
-
 	/*
 	 * SYSENTER doesn't filter flags, so we need to clear NT and AC
 	 * ourselves.  To save a few cycles, we can check whether
@@ -117,6 +113,16 @@ SYM_INNER_LABEL(entry_SYSENTER_compat_after_hwframe, SYM_L_GLOBAL)
 	jnz	.Lsysenter_fix_flags
 .Lsysenter_flags_fixed:
 
+	/*
+	 * CPU bugs mitigations mechanisms can call other functions. They
+	 * should be invoked after making sure TF is cleared because
+	 * single-step is ignored only for instructions inside the
+	 * entry_SYSENTER_compat function.
+	 */
+	IBRS_ENTER
+	UNTRAIN_RET
+	CLEAR_BRANCH_HISTORY
+
 	movq	%rsp, %rdi
 	call	do_SYSENTER_32
 	jmp	sysret32_from_system_call