From patchwork Fri Feb 5 19:15:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: thermal-bot for Julien Panis X-Patchwork-Id: 378077 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-20.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89AD3C433E0 for ; Fri, 5 Feb 2021 19:18:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3EEB864E3E for ; Fri, 5 Feb 2021 19:18:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233529AbhBERfs (ORCPT ); Fri, 5 Feb 2021 12:35:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55428 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233537AbhBERdg (ORCPT ); Fri, 5 Feb 2021 12:33:36 -0500 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7BCFCC06178A; Fri, 5 Feb 2021 11:15:14 -0800 (PST) Date: Fri, 05 Feb 2021 19:15:11 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1612552513; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xeBofFEAXxs91lUNgZRi8mOjh7QyCz8iKk9h+ob1osY=; b=Xxxl1hKoHIv7jQ625CvPLY7jlPUbR5aEFaOHHV/PfQWgHA+b+xgjdYDruFLcnVuaYCDn7n uyQzOMLCapvRBjOqeEz8g0xtORysvptjOC/zXKIAq32aH5gQW5NL5XaEbL4qzGRY0OAkUw s88R5XdC4UoEMRTxx9qXxx3EbA9/jjVG8klrFP0PIgocwM9N/+7vGSSMdRStyCZ3T4bkIf dAFE8m6IE59roygCA6DWxjjeXIC8d+XzmVWQU1JakHeqUd+HF5u1A8ChOALaUrdua2t0kL NxN4LapvlxIQTcAlA/bD1eF7KWVTcfNNWrKn7G7EnGwgsnAFrlQL+E5deHNxdA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1612552513; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xeBofFEAXxs91lUNgZRi8mOjh7QyCz8iKk9h+ob1osY=; b=y0up98m1JFsO8wF+44eCK2FsvHSR3WZ6+1jh8FZoR4nb8nKE2mL1YDOzn8DQWJ4Kq6fCpl 8EokMp2Zh58cQYCA== From: "tip-bot2 for Lai Jiangshan" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/urgent] x86/debug: Prevent data breakpoints on cpu_dr7 Cc: Lai Jiangshan , Thomas Gleixner , stable@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20210204152708.21308-2-jiangshanlai@gmail.com> References: <20210204152708.21308-2-jiangshanlai@gmail.com> MIME-Version: 1.0 Message-ID: <161255251192.23325.17821582532132807593.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 3943abf2dbfae9ea4d2da05c1db569a0603f76da Gitweb: https://git.kernel.org/tip/3943abf2dbfae9ea4d2da05c1db569a0603f76da Author: Lai Jiangshan AuthorDate: Thu, 04 Feb 2021 23:27:07 +08:00 Committer: Thomas Gleixner CommitterDate: Fri, 05 Feb 2021 20:13:12 +01:00 x86/debug: Prevent data breakpoints on cpu_dr7 local_db_save() is called at the start of exc_debug_kernel(), reads DR7 and disables breakpoints to prevent recursion. When running in a guest (X86_FEATURE_HYPERVISOR), local_db_save() reads the per-cpu variable cpu_dr7 to check whether a breakpoint is active or not before it accesses DR7. A data breakpoint on cpu_dr7 therefore results in infinite #DB recursion. Disallow data breakpoints on cpu_dr7 to prevent that. Fixes: 84b6a3491567a("x86/entry: Optimize local_db_save() for virt") Signed-off-by: Lai Jiangshan Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210204152708.21308-2-jiangshanlai@gmail.com --- arch/x86/kernel/hw_breakpoint.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c index 012ed82..668a4a6 100644 --- a/arch/x86/kernel/hw_breakpoint.c +++ b/arch/x86/kernel/hw_breakpoint.c @@ -307,6 +307,14 @@ static inline bool within_cpu_entry(unsigned long addr, unsigned long end) (unsigned long)&per_cpu(cpu_tlbstate, cpu), sizeof(struct tlb_state))) return true; + + /* + * When in guest (X86_FEATURE_HYPERVISOR), local_db_save() + * will read per-cpu cpu_dr7 before clear dr7 register. + */ + if (within_area(addr, end, (unsigned long)&per_cpu(cpu_dr7, cpu), + sizeof(cpu_dr7))) + return true; } return false;