mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-31 00:17:44 +00:00
Code Issues Releases Wiki Activity
linux-stable/arch/x86/kvm
History
Borislav Petkov fe83f5eae4 kvm/emulate: Fix SETcc emulation function offsets with SLS 
The commit in Fixes started adding INT3 after RETs as a mitigation
against straight-line speculation.

The fastop SETcc implementation in kvm's insn emulator uses macro magic
to generate all possible SETcc functions and to jump to them when
emulating the respective instruction.

However, it hardcodes the size and alignment of those functions to 4: a
three-byte SETcc insn and a single-byte RET. BUT, with SLS, there's an
INT3 that gets slapped after the RET, which brings the whole scheme out
of alignment:

  15:   0f 90 c0                seto   %al
  18:   c3                      ret
  19:   cc                      int3
  1a:   0f 1f 00                nopl   (%rax)
  1d:   0f 91 c0                setno  %al
  20:   c3                      ret
  21:   cc                      int3
  22:   0f 1f 00                nopl   (%rax)
  25:   0f 92 c0                setb   %al
  28:   c3                      ret
  29:   cc                      int3

and this explodes like this:

  int3: 0000 [#1] PREEMPT SMP PTI
  CPU: 0 PID: 2435 Comm: qemu-system-x86 Not tainted 5.17.0-rc8-sls #1
  Hardware name: Dell Inc. Precision WorkStation T3400  /0TP412, BIOS A14 04/30/2012
  RIP: 0010:setc+0x5/0x8 [kvm]
  Code: 00 00 0f 1f 00 0f b6 05 43 24 06 00 c3 cc 0f 1f 80 00 00 00 00 0f 90 c0 c3 cc 0f \
	  1f 00 0f 91 c0 c3 cc 0f 1f 00 0f 92 c0 c3 cc <0f> 1f 00 0f 93 c0 c3 cc 0f 1f 00 \
	  0f 94 c0 c3 cc 0f 1f 00 0f 95 c0
  Call Trace:
   <TASK>
   ? x86_emulate_insn [kvm]
   ? x86_emulate_instruction [kvm]
   ? vmx_handle_exit [kvm_intel]
   ? kvm_arch_vcpu_ioctl_run [kvm]
   ? kvm_vcpu_ioctl [kvm]
   ? __x64_sys_ioctl
   ? do_syscall_64
   ? entry_SYSCALL_64_after_hwframe
   </TASK>

Raise the alignment value when SLS is enabled and use a macro for that
instead of hard-coding naked numbers.

Fixes: e463a09af2 ("x86: Add straight-line-speculation mitigation")
Reported-by: Jamie Heilman <jamie@audible.transient.net>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Jamie Heilman <jamie@audible.transient.net>
Link: https://lore.kernel.org/r/YjGzJwjrvxg5YZ0Z@audible.transient.net
[Add a comment and a bit of safety checking, since this is going to be changed
 again for IBT support. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-20 14:55:46 +01:00
..
mmu KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() 2022-03-02 10:55:58 -05:00
svm KVM: x86: nSVM: disallow userspace setting of MSR_AMD64_TSC_RATIO to non default value when tsc scaling disabled 2022-02-24 13:04:47 -05:00
vmx Revert "KVM: VMX: Save HOST_CR3 in vmx_prepare_switch_to_guest()" 2022-02-25 04:02:18 -05:00
cpuid.c x86/kvm/fpu: Remove kvm_vcpu_arch.guest_supported_xcr0 2022-02-17 10:06:49 -05:00
cpuid.h kvm: x86: Add support for getting/setting expanded xstate buffer 2022-01-14 13:44:41 -05:00
debugfs.c Merge branch 'kvm-pi-raw-spinlock' into HEAD 2022-01-19 12:14:02 -05:00
emulate.c kvm/emulate: Fix SETcc emulation function offsets with SLS 2022-03-20 14:55:46 +01:00
fpu.h KVM: x86: Move FPU register accessors into fpu.h 2021-06-17 13:09:24 -04:00
hyperv.c Merge remote-tracking branch 'kvm/master' into HEAD 2021-12-21 12:51:09 -05:00
hyperv.h KVM: x86: Query vcpu->vcpu_idx directly and drop its accessor 2021-09-22 10:33:11 -04:00
i8254.c KVM: Use 'unsigned long' as kvm_for_each_vcpu()'s index 2021-12-08 04:24:15 -05:00
i8254.h
i8259.c KVM: Use 'unsigned long' as kvm_for_each_vcpu()'s index 2021-12-08 04:24:15 -05:00
ioapic.c KVM: Use 'unsigned long' as kvm_for_each_vcpu()'s index 2021-12-08 04:24:15 -05:00
ioapic.h x86/kvm: remove unused ack_notifier callbacks 2021-11-18 07:05:57 -05:00
irq.c KVM: x86/xen: Add event channel interrupt vector upcall 2021-02-04 14:19:39 +00:00
irq.h x86/kvm: remove unused ack_notifier callbacks 2021-11-18 07:05:57 -05:00
irq_comm.c KVM: x86/xen: Add KVM_IRQ_ROUTING_XEN_EVTCHN and event channel delivery 2022-01-07 10:44:45 -05:00
Kconfig RISCV: 2022-01-16 16:15:14 +02:00
kvm_cache_regs.h KVM: X86: Remove kvm_register_clear_available() 2021-12-08 04:25:03 -05:00
kvm_emulate.h KVM: x86: Update vPMCs when retiring branch instructions 2022-01-07 10:44:43 -05:00
kvm_onhyperv.c KVM: Use 'unsigned long' as kvm_for_each_vcpu()'s index 2021-12-08 04:24:15 -05:00
kvm_onhyperv.h KVM: x86: hyper-v: Move the remote TLB flush logic out of vmx 2021-06-17 13:09:36 -04:00
lapic.c KVM: x86: lapic: don't touch irr_pending in kvm_apic_update_apicv when inhibiting it 2022-02-08 13:30:49 -05:00
lapic.h KVM: x86: Rename kvm_lapic_enable_pv_eoi() 2021-11-11 10:56:22 -05:00
Makefile KVM: Add Makefile.kvm for common files, use it for x86 2021-12-09 12:56:02 -05:00
mmu.h KVM: X86: Add parameter huge_page_level to kvm_init_shadow_ept_mmu() 2021-12-08 04:25:12 -05:00
mtrr.c KVM: x86: Add helper to consolidate "raw" reserved GPA mask calculations 2021-02-04 09:27:30 -05:00
pmu.c KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW 2022-02-14 07:44:51 -05:00
pmu.h KVM: x86: Update vPMCs when retiring instructions 2022-01-07 10:44:42 -05:00
reverse_cpuid.h KVM: SEV: Mask CPUID[0x8000001F].eax according to supported features 2021-04-26 05:27:15 -04:00
trace.h KVM: x86: add a tracepoint for APICv/AVIC interrupt delivery 2021-12-09 09:07:39 -05:00
tss.h
x86.c KVM: x86: pull kvm->srcu read-side to kvm_arch_vcpu_ioctl_run 2022-03-02 10:55:58 -05:00
x86.h KVM/arm64 fixes for 5.17, take #2 2022-02-05 00:58:25 -05:00
xen.c KVM: x86/xen: Fix runstate updates to be atomic when preempting vCPU 2022-02-10 13:39:06 -05:00
xen.h KVM: x86/xen: Add KVM_IRQ_ROUTING_XEN_EVTCHN and event channel delivery 2022-01-07 10:44:45 -05:00