KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel

BugLink: https://bugs.launchpad.net/bugs/1853142
commit af2e8c68b9c5403f77096969c516f742f5bb29e0 upstream.

On some systems that are vulnerable to Spectre v2, it is up to
software to flush the link stack (return address stack), in order to
protect against Spectre-RSB.

When exiting from a guest we do some house keeping and then
potentially exit to C code which is several stack frames deep in the
host kernel. We will then execute a series of returns without
preceeding calls, opening up the possiblity that the guest could have
poisoned the link stack, and direct speculative execution of the host
to a gadget of some sort.

To prevent this we add a flush of the link stack on exit from a guest.

Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[dja: backport to Bionic's v4.15]
Signed-off-by: Daniel Axtens <dja@axtens.net>
CVE-2019-18660
Signed-off-by: Benjamin M Romer <benjamin.romer@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/arch/powerpc/include/asm/asm-prototypes.h b/arch/powerpc/include/asm/asm-prototypes.h
index 0cb97d9fb003f58d9cf551396cce772e5eecb04a..c363d747e9bb4bffc92b2fc8bdb108e65b3a776b 100644 (file)
--- a/arch/powerpc/include/asm/asm-prototypes.h
+++ b/arch/powerpc/include/asm/asm-prototypes.h
@@ -142,7 +142,9 @@ void _kvmppc_save_tm_pr(struct kvm_vcpu *vcpu, u64 guest_msr);
 extern s32 patch__call_flush_count_cache;
 extern s32 patch__flush_count_cache_return;
 extern s32 patch__flush_link_stack_return;
+extern s32 patch__call_kvm_flush_link_stack;
 
 extern long flush_count_cache;
+extern long kvm_flush_link_stack;
 
 #endif /* _ASM_POWERPC_ASM_PROTOTYPES_H */

diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
index 6e54a25f398bad7dcf1ec14416069bd0242dde60..a5c5940d970abf34cd77c5584ac22323b71313f6 100644 (file)
--- a/arch/powerpc/kernel/security.c
+++ b/arch/powerpc/kernel/security.c
@@ -392,6 +392,9 @@ static void toggle_count_cache_flush(bool enable)
 
        if (!enable) {
                patch_instruction_site(&patch__call_flush_count_cache, PPC_INST_NOP);
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+               patch_instruction_site(&patch__call_kvm_flush_link_stack, PPC_INST_NOP);
+#endif
                pr_info("link-stack-flush: software flush disabled.\n");
                link_stack_flush_enabled = false;
                no_count_cache_flush();
@@ -402,6 +405,12 @@ static void toggle_count_cache_flush(bool enable)
        patch_branch_site(&patch__call_flush_count_cache,
                          (u64)&flush_count_cache, BRANCH_SET_LINK);
 
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+       // This enables the branch from guest_exit_cont to kvm_flush_link_stack
+       patch_branch_site(&patch__call_kvm_flush_link_stack,
+                         (u64)&kvm_flush_link_stack, BRANCH_SET_LINK);
+#endif
+
        pr_info("link-stack-flush: software flush enabled.\n");
        link_stack_flush_enabled = true;
 

diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 80c49b0306f7185da0a3790c000cc557d848657d..b5bd2f4902b3d38f9eb04c0cc4bbcfca13b9a164 100644 (file)
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -18,6 +18,7 @@
  */
 
 #include <asm/ppc_asm.h>
+#include <asm/code-patching-asm.h>
 #include <asm/kvm_asm.h>
 #include <asm/reg.h>
 #include <asm/mmu.h>
@@ -1506,6 +1507,10 @@ mc_cont:
 1:
 #endif /* CONFIG_KVM_XICS */
 
+       /* Possibly flush the link stack here. */
+1:     nop
+       patch_site 1b patch__call_kvm_flush_link_stack
+
        /* For hash guest, read the guest SLB and save it away */
        ld      r5, VCPU_KVM(r9)
        lbz     r0, KVM_RADIX(r5)
@@ -2039,6 +2044,29 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
        mtlr    r0
        blr
 
+.balign 32
+.global kvm_flush_link_stack
+kvm_flush_link_stack:
+       /* Save LR into r0 */
+       mflr    r0
+
+       /* Flush the link stack. On Power8 it's up to 32 entries in size. */
+       .rept 32
+       bl      .+4
+       .endr
+
+       /* And on Power9 it's up to 64. */
+BEGIN_FTR_SECTION
+       .rept 32
+       bl      .+4
+       .endr
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+
+       /* Restore LR */
+       mtlr    r0
+       blr
+
+
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
 /*
  * Softpatch interrupt for transactional memory emulation cases