This is a note to let you know that I've just added the patch titled Revert "x86/speculation: Add RSB VM Exit protections" to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: revert-x86-speculation-add-rsb-vm-exit-protections.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From stable-owner@xxxxxxxxxxxxxxx Thu Nov 17 10:20:10 2022 From: Suleiman Souhlal <suleiman@xxxxxxxxxx> Date: Thu, 17 Nov 2022 18:19:19 +0900 Subject: Revert "x86/speculation: Add RSB VM Exit protections" To: stable@xxxxxxxxxxxxxxx Cc: x86@xxxxxxxxxx, kvm@xxxxxxxxxxxxxxx, bp@xxxxxxxxx, pbonzini@xxxxxxxxxx, peterz@xxxxxxxxxxxxx, jpoimboe@xxxxxxxxxx, cascardo@xxxxxxxxxxxxx, surajjs@xxxxxxxxxx, ssouhlal@xxxxxxxxxxx, suleiman@xxxxxxxxxx Message-ID: <20221117091952.1940850-2-suleiman@xxxxxxxxxx> From: Suleiman Souhlal <suleiman@xxxxxxxxxx> This reverts commit b6c5011934a15762cd694e36fe74f2f2f93eac9b. In order to apply IBRS mitigation for Retbleed, PBRSB mitigations must be reverted and the reapplied, so the backports can look sane. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx> Signed-off-by: Suleiman Souhlal <suleiman@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- Documentation/admin-guide/hw-vuln/spectre.rst | 8 --- arch/x86/include/asm/cpufeatures.h | 2 arch/x86/include/asm/msr-index.h | 4 - arch/x86/include/asm/nospec-branch.h | 15 ------ arch/x86/kernel/cpu/bugs.c | 61 -------------------------- arch/x86/kernel/cpu/common.c | 14 +---- arch/x86/kvm/vmx.c | 6 +- 7 files changed, 7 insertions(+), 103 deletions(-) --- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -422,14 +422,6 @@ The possible values in this file are: 'RSB filling' Protection of RSB on context switch enabled ============= =========================================== - - EIBRS Post-barrier Return Stack Buffer (PBRSB) protection status: - - =========================== ======================================================= - 'PBRSB-eIBRS: SW sequence' CPU is affected and protection of RSB on VMEXIT enabled - 'PBRSB-eIBRS: Vulnerable' CPU is vulnerable - 'PBRSB-eIBRS: Not affected' CPU is not affected by PBRSB - =========================== ======================================================= - Full mitigation might require a microcode update from the CPU vendor. When the necessary microcode is not available, the kernel will report vulnerability. --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -283,7 +283,6 @@ #define X86_FEATURE_CQM_MBM_LOCAL (11*32+ 3) /* LLC Local MBM monitoring */ #define X86_FEATURE_FENCE_SWAPGS_USER (11*32+ 4) /* "" LFENCE in user entry SWAPGS path */ #define X86_FEATURE_FENCE_SWAPGS_KERNEL (11*32+ 5) /* "" LFENCE in kernel entry SWAPGS path */ -#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+ 6) /* "" Fill RSB on VM exit when EIBRS is enabled */ /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */ #define X86_FEATURE_CLZERO (13*32+ 0) /* CLZERO instruction */ @@ -397,6 +396,5 @@ #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */ #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */ #define X86_BUG_MMIO_UNKNOWN X86_BUG(26) /* CPU is too old and its MMIO Stale Data status is unknown */ -#define X86_BUG_EIBRS_PBRSB X86_BUG(27) /* EIBRS is vulnerable to Post Barrier RSB Predictions */ #endif /* _ASM_X86_CPUFEATURES_H */ --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -120,10 +120,6 @@ * bit available to control VERW * behavior. */ -#define ARCH_CAP_PBRSB_NO BIT(24) /* - * Not susceptible to Post-Barrier - * Return Stack Buffer Predictions. - */ #define MSR_IA32_FLUSH_CMD 0x0000010b #define L1D_FLUSH BIT(0) /* --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -70,14 +70,6 @@ add $(BITS_PER_LONG/8) * nr, sp; #endif -/* Sequence to mitigate PBRSB on eIBRS CPUs */ -#define __ISSUE_UNBALANCED_RET_GUARD(sp) \ - call 881f; \ - int3; \ -881: \ - add $(BITS_PER_LONG/8), sp; \ - lfence; - #ifdef __ASSEMBLY__ /* @@ -293,13 +285,6 @@ static inline void vmexit_fill_RSB(void) : "=r" (loops), ASM_CALL_CONSTRAINT : : "memory" ); #endif - asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE - ALTERNATIVE("jmp 920f", - __stringify(__ISSUE_UNBALANCED_RET_GUARD(%0)), - X86_FEATURE_RSB_VMEXIT_LITE) - "920:" - : ASM_CALL_CONSTRAINT - : : "memory" ); } static __always_inline --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1046,49 +1046,6 @@ static enum spectre_v2_mitigation __init return SPECTRE_V2_RETPOLINE; } -static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_mitigation mode) -{ - /* - * Similar to context switches, there are two types of RSB attacks - * after VM exit: - * - * 1) RSB underflow - * - * 2) Poisoned RSB entry - * - * When retpoline is enabled, both are mitigated by filling/clearing - * the RSB. - * - * When IBRS is enabled, while #1 would be mitigated by the IBRS branch - * prediction isolation protections, RSB still needs to be cleared - * because of #2. Note that SMEP provides no protection here, unlike - * user-space-poisoned RSB entries. - * - * eIBRS should protect against RSB poisoning, but if the EIBRS_PBRSB - * bug is present then a LITE version of RSB protection is required, - * just a single call needs to retire before a RET is executed. - */ - switch (mode) { - case SPECTRE_V2_NONE: - /* These modes already fill RSB at vmexit */ - case SPECTRE_V2_LFENCE: - case SPECTRE_V2_RETPOLINE: - case SPECTRE_V2_EIBRS_RETPOLINE: - return; - - case SPECTRE_V2_EIBRS_LFENCE: - case SPECTRE_V2_EIBRS: - if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) { - setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT_LITE); - pr_info("Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT\n"); - } - return; - } - - pr_warn_once("Unknown Spectre v2 mode, disabling RSB mitigation at VM exit"); - dump_stack(); -} - static void __init spectre_v2_select_mitigation(void) { enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); @@ -1181,8 +1138,6 @@ static void __init spectre_v2_select_mit setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n"); - spectre_v2_determine_rsb_fill_type_at_vmexit(mode); - /* * Retpoline means the kernel is safe because it has no indirect * branches. Enhanced IBRS protects firmware too, so, enable restricted @@ -1918,19 +1873,6 @@ static char *ibpb_state(void) return ""; } -static char *pbrsb_eibrs_state(void) -{ - if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) { - if (boot_cpu_has(X86_FEATURE_RSB_VMEXIT_LITE) || - boot_cpu_has(X86_FEATURE_RETPOLINE)) - return ", PBRSB-eIBRS: SW sequence"; - else - return ", PBRSB-eIBRS: Vulnerable"; - } else { - return ", PBRSB-eIBRS: Not affected"; - } -} - static ssize_t spectre_v2_show_state(char *buf) { if (spectre_v2_enabled == SPECTRE_V2_LFENCE) @@ -1943,13 +1885,12 @@ static ssize_t spectre_v2_show_state(cha spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE) return sprintf(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n"); - return sprintf(buf, "%s%s%s%s%s%s%s\n", + return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], ibpb_state(), boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "", stibp_state(), boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "", - pbrsb_eibrs_state(), spectre_v2_module_string()); } --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -954,8 +954,7 @@ static void identify_cpu_without_cpuid(s #define MSBDS_ONLY BIT(5) #define NO_SWAPGS BIT(6) #define NO_ITLB_MULTIHIT BIT(7) -#define NO_EIBRS_PBRSB BIT(8) -#define NO_MMIO BIT(9) +#define NO_MMIO BIT(8) #define VULNWL(_vendor, _family, _model, _whitelist) \ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist } @@ -997,7 +996,7 @@ static const __initconst struct x86_cpu_ VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), - VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_EIBRS_PBRSB), + VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), /* * Technically, swapgs isn't serializing on AMD (despite it previously @@ -1007,9 +1006,7 @@ static const __initconst struct x86_cpu_ * good enough for our purposes. */ - VULNWL_INTEL(ATOM_TREMONT, NO_EIBRS_PBRSB), - VULNWL_INTEL(ATOM_TREMONT_L, NO_EIBRS_PBRSB), - VULNWL_INTEL(ATOM_TREMONT_X, NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB), + VULNWL_INTEL(ATOM_TREMONT_X, NO_ITLB_MULTIHIT), /* AMD Family 0xf - 0x12 */ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO), @@ -1169,11 +1166,6 @@ static void __init cpu_set_bug_bits(stru setup_force_cpu_bug(X86_BUG_MMIO_UNKNOWN); } - if (cpu_has(c, X86_FEATURE_IBRS_ENHANCED) && - !cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) && - !(ia32_cap & ARCH_CAP_PBRSB_NO)) - setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB); - if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) return; --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -10988,9 +10988,6 @@ static void __noclone vmx_vcpu_run(struc #endif ); - /* Eliminate branch target predictions from guest mode */ - vmexit_fill_RSB(); - vmx_enable_fb_clear(vmx); /* @@ -11013,6 +11010,9 @@ static void __noclone vmx_vcpu_run(struc x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0); + /* Eliminate branch target predictions from guest mode */ + vmexit_fill_RSB(); + /* All fields are clean at this point */ if (static_branch_unlikely(&enable_evmcs)) current_evmcs->hv_clean_fields |= Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are queue-4.19/x86-speculation-disable-rrsba-behavior.patch queue-4.19/revert-x86-speculation-add-rsb-vm-exit-protections.patch queue-4.19/kvm-vmx-fix-ibrs-handling-after-vmexit.patch queue-4.19/kvm-vmx-prevent-guest-rsb-poisoning-attacks-with-eibrs.patch queue-4.19/x86-cpufeature-add-facility-to-check-for-min-microcode-revisions.patch queue-4.19/x86-bugs-keep-a-per-cpu-ia32_spec_ctrl-value.patch queue-4.19/x86-cpu-amd-enumerate-btc_no.patch queue-4.19/x86-speculation-fix-firmware-entry-spec_ctrl-handling.patch queue-4.19/x86-speculation-add-spectre_v2-ibrs-option-to-support-kernel-ibrs.patch queue-4.19/x86-cpu-add-consistent-cpu-match-macros.patch queue-4.19/x86-speculation-remove-x86_spec_ctrl_mask.patch queue-4.19/x86-bugs-add-cannon-lake-to-retbleed-affected-cpu-list.patch queue-4.19/x86-bugs-warn-when-ibrs-mitigation-is-selected-on-enhanced-ibrs-parts.patch queue-4.19/x86-speculation-fill-rsb-on-vmexit-for-ibrs.patch queue-4.19/x86-cpu-add-a-steppings-field-to-struct-x86_cpu_id.patch queue-4.19/x86-common-stamp-out-the-stepping-madness.patch queue-4.19/x86-bugs-split-spectre_v2_select_mitigation-and-spectre_v2_user_select_mitigation.patch queue-4.19/x86-bugs-report-intel-retbleed-vulnerability.patch queue-4.19/x86-speculation-change-fill_return_buffer-to-work-with-objtool.patch queue-4.19/x86-cpufeatures-move-retpoline-flags-to-word-11.patch queue-4.19/x86-speculation-fix-spec_ctrl-write-on-smt-state-change.patch queue-4.19/x86-bugs-optimize-spec_ctrl-msr-writes.patch queue-4.19/x86-bugs-report-amd-retbleed-vulnerability.patch queue-4.19/x86-speculation-fix-rsb-filling-with-config_retpoline-n.patch queue-4.19/x86-cpufeature-fix-various-quality-problems-in-the-asm-cpu_device_hd.h-header.patch queue-4.19/intel_idle-disable-ibrs-during-long-idle.patch queue-4.19/x86-speculation-use-declare_per_cpu-for-x86_spec_ctrl_current.patch queue-4.19/x86-entry-remove-skip_r11rcx.patch queue-4.19/x86-speculation-use-cached-host-spec_ctrl-value-for-guest-entry-exit.patch queue-4.19/x86-devicetable-move-x86-specific-macro-out-of-generic-code.patch queue-4.19/x86-bugs-add-amd-retbleed-boot-parameter.patch queue-4.19/x86-entry-add-kernel-ibrs-implementation.patch queue-4.19/revert-x86-cpu-add-a-steppings-field-to-struct-x86_cpu_id.patch queue-4.19/x86-speculation-add-rsb-vm-exit-protections.patch