Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 12 Jul 2023 11:49:00 +0100
Message-ID: <86351twgkj.wl-maz@kernel.org>
From:   Marc Zyngier <maz@kernel.org>
To:     Mostafa Saleh <smostafa@google.com>
Cc:     oliver.upton@linux.dev, linux-arm-kernel@lists.infradead.org,
        kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org,
        tabba@google.com, qperret@google.com, will@kernel.org,
        catalin.marinas@arm.com, yuzenghui@huawei.com,
        suzuki.poulose@arm.com, james.morse@arm.com, bgardon@google.com,
        gshan@redhat.com, sudeep.holla@arm.com
Subject: Re: [PATCH v2] KVM: arm64: Add missing BTI instructions
In-Reply-To: <20230706152240.685684-1-smostafa@google.com>
References: <20230706152240.685684-1-smostafa@google.com>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue)
 FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/28.2
 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue")
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk

On Thu, 06 Jul 2023 16:22:40 +0100,
Mostafa Saleh <smostafa@google.com> wrote:
> 
> Some bti instructions were missing from
> commit b53d4a272349 ("KVM: arm64: Use BTI for nvhe")
> 
> 1) kvm_host_psci_cpu_entry
> kvm_host_psci_cpu_entry is called from __kvm_hyp_init_cpu through "br"
> instruction as __kvm_hyp_init_cpu resides in idmap section while
> kvm_host_psci_cpu_entry is in hyp .text so the offset is larger than
> 128MB range covered by "b".
> Which means that this function should start with "bti j" instruction.
> 
> LLVM which is the only compiler supporting BTI for Linux, adds "bti j"
> for jump tables or by when taking the address of the block [1].
> Same behaviour is observed with GCC.
> 
> As kvm_host_psci_cpu_entry is a C function, this must be done in
> assembly.
> 
> Another solution is to use X16/X17 with "br", as according to ARM
> ARM DDI0487I.a RLJHCL/IGMGRS, PACIASP has an implicit branch
> target identification instruction that is compatible with
> PSTATE.BTYPE 0b01 which includes "br X16/X17"
> And the kvm_host_psci_cpu_entry has PACIASP as it is an external
> function.
> Although, using explicit "bti" makes it more clear than relying on
> which register is used.
> 
> A third solution is to clear SCTLR_EL2.BT, which would make PACIASP
> compatible PSTATE.BTYPE 0b11 ("br" to other registers).
> However this deviates from the kernel behaviour (in bti_enable()).
> 
> 2) Spectre vector table
> "br" instructions are generated at runtime for the vector table
> (__bp_harden_hyp_vecs).
> These branches would land on vectors in __kvm_hyp_vector at offset 8.
> As all the macros are defined with valid_vect/invalid_vect, it is
> sufficient to add "bti j" at the correct offset.
> 
> [1] https://reviews.llvm.org/D52867
> 
> Fixes: b53d4a272349 ("KVM: arm64: Use BTI for nvhe")
> Signed-off-by: Mostafa Saleh <smostafa@google.com>
> Reported-by: Sudeep Holla <sudeep.holla@arm.com>
> ---
> v1 -> v2:
> - Add another missing bti in spectre vector table.
> v1: https://lore.kernel.org/all/20230705171632.3912123-1-smostafa@google.com/

Acked-by: Marc Zyngier <maz@kernel.org>

	M.

-- 
Without deviation from the norm, progress is not possible.