Received: by 2002:a25:7ec1:0:0:0:0:0 with SMTP id z184csp6001804ybc; Wed, 27 Nov 2019 13:12:05 -0800 (PST) X-Google-Smtp-Source: APXvYqyldL5pK8Q6v5CpWionap1MXQDTrGgY/lc+wY5m/aYhoAcopsQdhqph4QA8jyE0Cs9VqaKD X-Received: by 2002:a05:6402:305b:: with SMTP id bu27mr34946789edb.191.1574889125881; Wed, 27 Nov 2019 13:12:05 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1574889125; cv=none; d=google.com; s=arc-20160816; b=Wjr3SP1PpXpE1tsgV6SoZSphIyRF3Zn44om2sPyN2T4a4UGU1//1n+ZSBjZiYroWXK JtsCmtbRPbXS29iGfrykSTQGOBJJN2+Egv3xgoiOkD9sfOMBUNlyjwH85wdwLiL2I540 Z6A4aUZpiuUZ+7pTHOM2qfGfB6fj4zEK8lK7jXI4UXP/NVl3vG31+wDxK487K0BH3W4E Ufmc2BStRAAzjPdLz1uE7+oXIACauVS8a/ygoWa02S9ICOuAXTsfkYoJj8Z65jM2HeQn RyOsbzm8SlllxXUAMnImRSyYgMS+glCsNSUiwTPSgH/daMWZsuGg7MwNQJRFk+lB/1/3 nt4Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=bDjXsHAk1kmwp+oSzlFNI2SxmrlV5zH2F/UC6y8vp0w=; b=dFL0SD4cCDDYPTsGGnDj/XPW+eCl6K2x0o/FMIvEl1PjXAJsPdzBJaqTOviTU1R0V3 s1cx6yYtw6d8+czkObJrnw4+c1CAKNt+8Zfb0l9wuVLvX9DuXr5tr83zhMn6ei3IYi/B hrFNZBs5wROPjOuUa0aEhjDot5G9qiS/+of7YGhj4IlZIxcYn0TrYX6BgOWp6nJSLt8v ztM/krHQOd6UjnPZ7EazIP4T3i9qyeWN/u3SZ2EO7Qow5sKrCZiJ37BcaS4+SspYlnej nfSZL1ZpplNB7FNU54sfL2ZbptQr2lbKrgHyvq0IcNe9TD5Mt7ZIza0G5r1oShFOsrOw 5YQQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=s71X72Tp; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a15si12214568edu.427.2019.11.27.13.11.42; Wed, 27 Nov 2019 13:12:05 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=s71X72Tp; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732697AbfK0VIF (ORCPT + 99 others); Wed, 27 Nov 2019 16:08:05 -0500 Received: from mail.kernel.org ([198.145.29.99]:34368 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732689AbfK0VID (ORCPT ); Wed, 27 Nov 2019 16:08:03 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 632EA2176D; Wed, 27 Nov 2019 21:08:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574888881; bh=B9g0mzV11oR8dfWobeC/zjd9RLJyGInX0NdtnEKSC2E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s71X72Tp7Br6fjPbb0Cg/DBsHtMxwOWwjmyzw5v/0Y+ooeiYnNkFTlDBQtIiv9qG7 2ZugZADRERyL8lT3Dn5mbPcPW/Y6hgAsg+5nOqUBeXCcLrTAWEih50OmsLXo67fbR4 Nkm75NK8TiXkjMnUySZ1nLhXNsOfK/+6U49yC8qw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Ellerman , Daniel Axtens Subject: [PATCH 4.19 306/306] KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel Date: Wed, 27 Nov 2019 21:32:36 +0100 Message-Id: <20191127203137.064576082@linuxfoundation.org> X-Mailer: git-send-email 2.24.0 In-Reply-To: <20191127203114.766709977@linuxfoundation.org> References: <20191127203114.766709977@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michael Ellerman commit af2e8c68b9c5403f77096969c516f742f5bb29e0 upstream. On some systems that are vulnerable to Spectre v2, it is up to software to flush the link stack (return address stack), in order to protect against Spectre-RSB. When exiting from a guest we do some house keeping and then potentially exit to C code which is several stack frames deep in the host kernel. We will then execute a series of returns without preceeding calls, opening up the possiblity that the guest could have poisoned the link stack, and direct speculative execution of the host to a gadget of some sort. To prevent this we add a flush of the link stack on exit from a guest. Signed-off-by: Michael Ellerman [dja: straightforward backport to v4.19] Signed-off-by: Daniel Axtens Signed-off-by: Greg Kroah-Hartman --- arch/powerpc/include/asm/asm-prototypes.h | 2 ++ arch/powerpc/kernel/security.c | 9 +++++++++ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 28 ++++++++++++++++++++++++++++ 3 files changed, 39 insertions(+) --- a/arch/powerpc/include/asm/asm-prototypes.h +++ b/arch/powerpc/include/asm/asm-prototypes.h @@ -147,8 +147,10 @@ void _kvmppc_save_tm_pr(struct kvm_vcpu extern s32 patch__call_flush_count_cache; extern s32 patch__flush_count_cache_return; extern s32 patch__flush_link_stack_return; +extern s32 patch__call_kvm_flush_link_stack; extern s32 patch__memset_nocache, patch__memcpy_nocache; extern long flush_count_cache; +extern long kvm_flush_link_stack; #endif /* _ASM_POWERPC_ASM_PROTOTYPES_H */ --- a/arch/powerpc/kernel/security.c +++ b/arch/powerpc/kernel/security.c @@ -392,6 +392,9 @@ static void toggle_count_cache_flush(boo if (!enable) { patch_instruction_site(&patch__call_flush_count_cache, PPC_INST_NOP); +#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE + patch_instruction_site(&patch__call_kvm_flush_link_stack, PPC_INST_NOP); +#endif pr_info("link-stack-flush: software flush disabled.\n"); link_stack_flush_enabled = false; no_count_cache_flush(); @@ -402,6 +405,12 @@ static void toggle_count_cache_flush(boo patch_branch_site(&patch__call_flush_count_cache, (u64)&flush_count_cache, BRANCH_SET_LINK); +#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE + // This enables the branch from guest_exit_cont to kvm_flush_link_stack + patch_branch_site(&patch__call_kvm_flush_link_stack, + (u64)&kvm_flush_link_stack, BRANCH_SET_LINK); +#endif + pr_info("link-stack-flush: software flush enabled.\n"); link_stack_flush_enabled = true; --- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S +++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S @@ -18,6 +18,7 @@ */ #include +#include #include #include #include @@ -1559,6 +1560,10 @@ mc_cont: 1: #endif /* CONFIG_KVM_XICS */ + /* Possibly flush the link stack here. */ +1: nop + patch_site 1b patch__call_kvm_flush_link_stack + /* For hash guest, read the guest SLB and save it away */ ld r5, VCPU_KVM(r9) lbz r0, KVM_RADIX(r5) @@ -2107,6 +2112,29 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) mtlr r0 blr +.balign 32 +.global kvm_flush_link_stack +kvm_flush_link_stack: + /* Save LR into r0 */ + mflr r0 + + /* Flush the link stack. On Power8 it's up to 32 entries in size. */ + .rept 32 + bl .+4 + .endr + + /* And on Power9 it's up to 64. */ +BEGIN_FTR_SECTION + .rept 32 + bl .+4 + .endr +END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) + + /* Restore LR */ + mtlr r0 + blr + + #ifdef CONFIG_PPC_TRANSACTIONAL_MEM /* * Softpatch interrupt for transactional memory emulation cases