This is a note to let you know that I've just added the patch titled KVM: VMX: Prevent RSB underflow before vmenter to the 5.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: kvm-vmx-prevent-rsb-underflow-before-vmenter.patch and it can be found in the queue-5.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Tue Jul 12 05:03:58 PM CEST 2022 From: Josh Poimboeuf <jpoimboe@xxxxxxxxxx> Date: Tue, 14 Jun 2022 23:16:16 +0200 Subject: KVM: VMX: Prevent RSB underflow before vmenter From: Josh Poimboeuf <jpoimboe@xxxxxxxxxx> commit 07853adc29a058c5fd143c14e5ac528448a72ed9 upstream. On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter. Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns. For maximum paranoia, don't allow *any* returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter. [ bp: Fix 32-bit build. ] Signed-off-by: Josh Poimboeuf <jpoimboe@xxxxxxxxxx> Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx> Signed-off-by: Borislav Petkov <bp@xxxxxxx> [cascardo: header conflict fixup at arch/x86/kernel/asm-offsets.c] Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/x86/kernel/asm-offsets.c | 6 ++++++ arch/x86/kernel/cpu/bugs.c | 4 ++-- arch/x86/kvm/vmx/capabilities.h | 4 ++-- arch/x86/kvm/vmx/vmenter.S | 29 +++++++++++++++++++++++++++++ arch/x86/kvm/vmx/vmx.c | 8 -------- arch/x86/kvm/vmx/vmx.h | 4 ++-- arch/x86/kvm/vmx/vmx_ops.h | 2 +- 7 files changed, 42 insertions(+), 15 deletions(-) --- a/arch/x86/kernel/asm-offsets.c +++ b/arch/x86/kernel/asm-offsets.c @@ -18,6 +18,7 @@ #include <asm/bootparam.h> #include <asm/suspend.h> #include <asm/tlbflush.h> +#include "../kvm/vmx/vmx.h" #ifdef CONFIG_XEN #include <xen/interface/xen.h> @@ -90,4 +91,9 @@ static void __used common(void) OFFSET(TSS_sp0, tss_struct, x86_tss.sp0); OFFSET(TSS_sp1, tss_struct, x86_tss.sp1); OFFSET(TSS_sp2, tss_struct, x86_tss.sp2); + + if (IS_ENABLED(CONFIG_KVM_INTEL)) { + BLANK(); + OFFSET(VMX_spec_ctrl, vcpu_vmx, spec_ctrl); + } } --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -196,8 +196,8 @@ void __init check_bugs(void) } /* - * NOTE: For VMX, this function is not called in the vmexit path. - * It uses vmx_spec_ctrl_restore_host() instead. + * NOTE: This function is *only* called for SVM. VMX spec_ctrl handling is + * done in vmenter.S. */ void x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest) --- a/arch/x86/kvm/vmx/capabilities.h +++ b/arch/x86/kvm/vmx/capabilities.h @@ -4,8 +4,8 @@ #include <asm/vmx.h> -#include "lapic.h" -#include "x86.h" +#include "../lapic.h" +#include "../x86.h" extern bool __read_mostly enable_vpid; extern bool __read_mostly flexpriority_enabled; --- a/arch/x86/kvm/vmx/vmenter.S +++ b/arch/x86/kvm/vmx/vmenter.S @@ -1,9 +1,11 @@ /* SPDX-License-Identifier: GPL-2.0 */ #include <linux/linkage.h> #include <asm/asm.h> +#include <asm/asm-offsets.h> #include <asm/bitsperlong.h> #include <asm/kvm_vcpu_regs.h> #include <asm/nospec-branch.h> +#include <asm/percpu.h> #include <asm/segment.h> #include "run_flags.h" @@ -73,6 +75,33 @@ SYM_FUNC_START(__vmx_vcpu_run) lea (%_ASM_SP), %_ASM_ARG2 call vmx_update_host_rsp + ALTERNATIVE "jmp .Lspec_ctrl_done", "", X86_FEATURE_MSR_SPEC_CTRL + + /* + * SPEC_CTRL handling: if the guest's SPEC_CTRL value differs from the + * host's, write the MSR. + * + * IMPORTANT: To avoid RSB underflow attacks and any other nastiness, + * there must not be any returns or indirect branches between this code + * and vmentry. + */ + mov 2*WORD_SIZE(%_ASM_SP), %_ASM_DI + movl VMX_spec_ctrl(%_ASM_DI), %edi + movl PER_CPU_VAR(x86_spec_ctrl_current), %esi + cmp %edi, %esi + je .Lspec_ctrl_done + mov $MSR_IA32_SPEC_CTRL, %ecx + xor %edx, %edx + mov %edi, %eax + wrmsr + +.Lspec_ctrl_done: + + /* + * Since vmentry is serializing on affected CPUs, there's no need for + * an LFENCE to stop speculation from skipping the wrmsr. + */ + /* Load @regs to RAX. */ mov (%_ASM_SP), %_ASM_AX --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -6989,14 +6989,6 @@ static fastpath_t vmx_vcpu_run(struct kv kvm_wait_lapic_expire(vcpu); - /* - * If this vCPU has touched SPEC_CTRL, restore the guest's value if - * it's non-zero. Since vmentry is serialising on affected CPUs, there - * is no need to worry about the conditional branch over the wrmsr - * being speculatively taken. - */ - x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0); - /* The actual VMENTER/EXIT is in the .noinstr.text section. */ vmx_vcpu_enter_exit(vcpu, vmx, __vmx_vcpu_run_flags(vmx)); --- a/arch/x86/kvm/vmx/vmx.h +++ b/arch/x86/kvm/vmx/vmx.h @@ -8,11 +8,11 @@ #include <asm/intel_pt.h> #include "capabilities.h" -#include "kvm_cache_regs.h" +#include "../kvm_cache_regs.h" #include "posted_intr.h" #include "vmcs.h" #include "vmx_ops.h" -#include "cpuid.h" +#include "../cpuid.h" #include "run_flags.h" #define MSR_TYPE_R 1 --- a/arch/x86/kvm/vmx/vmx_ops.h +++ b/arch/x86/kvm/vmx/vmx_ops.h @@ -8,7 +8,7 @@ #include "evmcs.h" #include "vmcs.h" -#include "x86.h" +#include "../x86.h" asmlinkage void vmread_error(unsigned long field, bool fault); __attribute__((regparm(0))) void vmread_error_trampoline(unsigned long field, Patches currently in stable-queue which might be from jpoimboe@xxxxxxxxxx are queue-5.18/x86-sev-avoid-using-__x86_return_thunk.patch queue-5.18/kvm-vmx-prevent-rsb-underflow-before-vmenter.patch queue-5.18/x86-ftrace-use-alternative-ret-encoding.patch queue-5.18/objtool-re-add-unwind_hint_-save_restore.patch queue-5.18/x86-bugs-add-retbleed-ibpb.patch queue-5.18/x86-retpoline-cleanup-some-ifdefery.patch queue-5.18/kvm-vmx-flatten-__vmx_vcpu_run.patch queue-5.18/x86-cpu-amd-add-spectral-chicken.patch queue-5.18/kvm-vmx-fix-ibrs-handling-after-vmexit.patch queue-5.18/kvm-vmx-prevent-guest-rsb-poisoning-attacks-with-eibrs.patch queue-5.18/x86-vsyscall_emu-64-don-t-use-ret-in-vsyscall-emulation.patch queue-5.18/objtool-skip-non-text-sections-when-adding-return-thunk-sites.patch queue-5.18/x86-bugs-do-ibpb-fallback-check-only-once.patch queue-5.18/x86-add-magic-amd-return-thunk.patch queue-5.18/x86-bugs-keep-a-per-cpu-ia32_spec_ctrl-value.patch queue-5.18/x86-objtool-create-.return_sites.patch queue-5.18/x86-kvm-fix-setcc-emulation-for-return-thunks.patch queue-5.18/x86-retpoline-swizzle-retpoline-thunk.patch queue-5.18/x86-speculation-fix-firmware-entry-spec_ctrl-handling.patch queue-5.18/x86-speculation-add-spectre_v2-ibrs-option-to-support-kernel-ibrs.patch queue-5.18/x86-xen-add-untrain_ret.patch queue-5.18/x86-undo-return-thunk-damage.patch queue-5.18/x86-speculation-remove-x86_spec_ctrl_mask.patch queue-5.18/x86-entry-avoid-very-early-ret.patch queue-5.18/x86-speculation-fill-rsb-on-vmexit-for-ibrs.patch queue-5.18/objtool-add-entry-unret-validation.patch queue-5.18/kvm-vmx-convert-launched-argument-to-flags.patch queue-5.18/x86-bpf-use-alternative-ret-encoding.patch queue-5.18/x86-bugs-split-spectre_v2_select_mitigation-and-spectre_v2_user_select_mitigation.patch queue-5.18/x86-bugs-report-intel-retbleed-vulnerability.patch queue-5.18/x86-cpufeatures-move-retpoline-flags-to-word-11.patch queue-5.18/x86-speculation-fix-spec_ctrl-write-on-smt-state-change.patch queue-5.18/x86-retpoline-use-mfunction-return.patch queue-5.18/x86-xen-rename-sys-entry-points.patch queue-5.18/x86-bugs-optimize-spec_ctrl-msr-writes.patch queue-5.18/x86-bugs-report-amd-retbleed-vulnerability.patch queue-5.18/x86-static_call-use-alternative-ret-encoding.patch queue-5.18/x86-speculation-fix-rsb-filling-with-config_retpoline-n.patch queue-5.18/x86-use-return-thunk-in-asm-code.patch queue-5.18/intel_idle-disable-ibrs-during-long-idle.patch queue-5.18/x86-speculation-use-cached-host-spec_ctrl-value-for-guest-entry-exit.patch queue-5.18/x86-bugs-add-amd-retbleed-boot-parameter.patch queue-5.18/x86-entry-add-kernel-ibrs-implementation.patch queue-5.18/objtool-treat-.text.__x86.-as-noinstr.patch queue-5.18/objtool-update-retpoline-validation.patch