From patchwork Thu Nov 28 15:05:24 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Benjamin M Romer X-Patchwork-Id: 1202111 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 47P1D01x2fz9sPh; Fri, 29 Nov 2019 02:05:36 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1iaLML-0004pd-H2; Thu, 28 Nov 2019 15:05:33 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1iaLMF-0004mM-KY for kernel-team@lists.ubuntu.com; Thu, 28 Nov 2019 15:05:27 +0000 Received: from mail-qk1-f198.google.com ([209.85.222.198]) by youngberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1iaLMF-0003ok-Cm for kernel-team@lists.ubuntu.com; Thu, 28 Nov 2019 15:05:27 +0000 Received: by mail-qk1-f198.google.com with SMTP id r2so16218024qkb.2 for ; Thu, 28 Nov 2019 07:05:27 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=LP7dxrqBsL5jepQJJm8OrM2fo08DPsGLNUvnmmsB2gI=; b=MNQRlx5z+0Hw5om/0DKfXwkg9ejZymDJLT5YIuYswARaWMAfTPGPSG7msBQ8594aBV mBGQWAvCh/RnQiAWFsk4NQ40KhZLFjhX1fIJ3e3mwZMwTmhLm2qEXrGuX6WCJ8oQnL/a OOowef5tzBTyDKo3puODbpc9gSxeT8Z1FmU1itI30xRuH1K3JeS8YITeGHdLy92T3oRl qShfrvweLgXV8pjuPyhWeMfL0fFQnYmDShQFW+My1W4bHI4G3opLnixY+S1UQ8viNX7i qWn7aAwKU3uGPTR/umgzKsaBoovKVyT07pCsy2FAy66KV6Xw9x5hZx9SCyNky2Nmj1Ex suvg== X-Gm-Message-State: APjAAAUf8huzg7+S9yXgNB++yZf1WAm3yASHNpSlhQF7QhRmA4lIN8kD C7LynntRm8KBfhsBu7r3O5pP9Dji1iRQyJ95Ib+sEyf4xx6WAA/Ki4GCUD7cS3QTi6MsuEKmUIq gqYk2xaetTXwsQCOGvyKVkKaqgjETOwPDd2tYrSfhEA== X-Received: by 2002:ac8:750e:: with SMTP id u14mr5910883qtq.68.1574953526279; Thu, 28 Nov 2019 07:05:26 -0800 (PST) X-Google-Smtp-Source: APXvYqzBuNSiSShh26lzMyq9+hncq6QaBJGdkA7lh3TmQ0Ak/Ydh3l9u1n8GolDdrRPuTlItJffVKA== X-Received: by 2002:ac8:750e:: with SMTP id u14mr5910857qtq.68.1574953525960; Thu, 28 Nov 2019 07:05:25 -0800 (PST) Received: from beast (c-68-80-13-9.hsd1.pa.comcast.net. [68.80.13.9]) by smtp.gmail.com with ESMTPSA id t27sm8536440qkm.19.2019.11.28.07.05.25 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 Nov 2019 07:05:25 -0800 (PST) Received: from ben by beast with local (Exim 4.92.1) (envelope-from ) id 1iaLMC-0008Cg-Fj for kernel-team@lists.ubuntu.com; Thu, 28 Nov 2019 10:05:24 -0500 From: Benjamin M Romer To: kernel-team@lists.ubuntu.com Subject: [bionic][PATCH 3/3] KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel Date: Thu, 28 Nov 2019 10:05:24 -0500 Message-Id: <20191128150524.31487-4-benjamin.romer@canonical.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191128150524.31487-1-benjamin.romer@canonical.com> References: <20191128150524.31487-1-benjamin.romer@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Michael Ellerman BugLink: https://bugs.launchpad.net/bugs/1853142 commit af2e8c68b9c5403f77096969c516f742f5bb29e0 upstream. On some systems that are vulnerable to Spectre v2, it is up to software to flush the link stack (return address stack), in order to protect against Spectre-RSB. When exiting from a guest we do some house keeping and then potentially exit to C code which is several stack frames deep in the host kernel. We will then execute a series of returns without preceeding calls, opening up the possiblity that the guest could have poisoned the link stack, and direct speculative execution of the host to a gadget of some sort. To prevent this we add a flush of the link stack on exit from a guest. Signed-off-by: Michael Ellerman [dja: backport to Bionic's v4.15] Signed-off-by: Daniel Axtens CVE-2019-18660 Signed-off-by: Benjamin M Romer --- arch/powerpc/include/asm/asm-prototypes.h | 2 ++ arch/powerpc/kernel/security.c | 9 ++++++++ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 28 +++++++++++++++++++++++ 3 files changed, 39 insertions(+) diff --git a/arch/powerpc/include/asm/asm-prototypes.h b/arch/powerpc/include/asm/asm-prototypes.h index 0cb97d9fb003..c363d747e9bb 100644 --- a/arch/powerpc/include/asm/asm-prototypes.h +++ b/arch/powerpc/include/asm/asm-prototypes.h @@ -142,7 +142,9 @@ void _kvmppc_save_tm_pr(struct kvm_vcpu *vcpu, u64 guest_msr); extern s32 patch__call_flush_count_cache; extern s32 patch__flush_count_cache_return; extern s32 patch__flush_link_stack_return; +extern s32 patch__call_kvm_flush_link_stack; extern long flush_count_cache; +extern long kvm_flush_link_stack; #endif /* _ASM_POWERPC_ASM_PROTOTYPES_H */ diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c index 6e54a25f398b..a5c5940d970a 100644 --- a/arch/powerpc/kernel/security.c +++ b/arch/powerpc/kernel/security.c @@ -392,6 +392,9 @@ static void toggle_count_cache_flush(bool enable) if (!enable) { patch_instruction_site(&patch__call_flush_count_cache, PPC_INST_NOP); +#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE + patch_instruction_site(&patch__call_kvm_flush_link_stack, PPC_INST_NOP); +#endif pr_info("link-stack-flush: software flush disabled.\n"); link_stack_flush_enabled = false; no_count_cache_flush(); @@ -402,6 +405,12 @@ static void toggle_count_cache_flush(bool enable) patch_branch_site(&patch__call_flush_count_cache, (u64)&flush_count_cache, BRANCH_SET_LINK); +#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE + // This enables the branch from guest_exit_cont to kvm_flush_link_stack + patch_branch_site(&patch__call_kvm_flush_link_stack, + (u64)&kvm_flush_link_stack, BRANCH_SET_LINK); +#endif + pr_info("link-stack-flush: software flush enabled.\n"); link_stack_flush_enabled = true; diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S index 80c49b0306f7..b5bd2f4902b3 100644 --- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S +++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S @@ -18,6 +18,7 @@ */ #include +#include #include #include #include @@ -1506,6 +1507,10 @@ mc_cont: 1: #endif /* CONFIG_KVM_XICS */ + /* Possibly flush the link stack here. */ +1: nop + patch_site 1b patch__call_kvm_flush_link_stack + /* For hash guest, read the guest SLB and save it away */ ld r5, VCPU_KVM(r9) lbz r0, KVM_RADIX(r5) @@ -2039,6 +2044,29 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) mtlr r0 blr +.balign 32 +.global kvm_flush_link_stack +kvm_flush_link_stack: + /* Save LR into r0 */ + mflr r0 + + /* Flush the link stack. On Power8 it's up to 32 entries in size. */ + .rept 32 + bl .+4 + .endr + + /* And on Power9 it's up to 64. */ +BEGIN_FTR_SECTION + .rept 32 + bl .+4 + .endr +END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) + + /* Restore LR */ + mtlr r0 + blr + + #ifdef CONFIG_PPC_TRANSACTIONAL_MEM /* * Softpatch interrupt for transactional memory emulation cases