From: Borislav Petkov <bp@suse.de>

Date: Wed, 16 Mar 2022 22:05:52 +0100

Subject: kvm/emulate: Fix SETcc emulation function offsets with SLS

Git-commit: fe83f5eae432ccc8e90082d6ed506d5233547473

Patch-mainline: v5.17

References: bsc#1201930

The commit in Fixes started adding INT3 after RETs as a mitigation

against straight-line speculation.

The fastop SETcc implementation in kvm's insn emulator uses macro magic

to generate all possible SETcc functions and to jump to them when

emulating the respective instruction.

However, it hardcodes the size and alignment of those functions to 4: a

three-byte SETcc insn and a single-byte RET. BUT, with SLS, there's an

INT3 that gets slapped after the RET, which brings the whole scheme out

of alignment:

  15:   0f 90 c0                seto   %al

  18:   c3                      ret

  19:   cc                      int3

  1a:   0f 1f 00                nopl   (%rax)

  1d:   0f 91 c0                setno  %al

  20:   c3                      ret

  21:   cc                      int3

  22:   0f 1f 00                nopl   (%rax)

  25:   0f 92 c0                setb   %al

  28:   c3                      ret

  29:   cc                      int3

and this explodes like this:

  int3: 0000 [#1] PREEMPT SMP PTI

  CPU: 0 PID: 2435 Comm: qemu-system-x86 Not tainted 5.17.0-rc8-sls #1

  Hardware name: Dell Inc. Precision WorkStation T3400  /0TP412, BIOS A14 04/30/2012

  RIP: 0010:setc+0x5/0x8 [kvm]

  Code: 00 00 0f 1f 00 0f b6 05 43 24 06 00 c3 cc 0f 1f 80 00 00 00 00 0f 90 c0 c3 cc 0f \

	  1f 00 0f 91 c0 c3 cc 0f 1f 00 0f 92 c0 c3 cc <0f> 1f 00 0f 93 c0 c3 cc 0f 1f 00 \

	  0f 94 c0 c3 cc 0f 1f 00 0f 95 c0

  Call Trace:

   <TASK>

   ? x86_emulate_insn [kvm]

   ? x86_emulate_instruction [kvm]

   ? vmx_handle_exit [kvm_intel]

   ? kvm_arch_vcpu_ioctl_run [kvm]

   ? kvm_vcpu_ioctl [kvm]

   ? __x64_sys_ioctl

   ? do_syscall_64

   ? entry_SYSCALL_64_after_hwframe

   </TASK>

Raise the alignment value when SLS is enabled and use a macro for that

instead of hard-coding naked numbers.

Fixes: e463a09af2f0 ("x86: Add straight-line-speculation mitigation")

Reported-by: Jamie Heilman <jamie@audible.transient.net>

Signed-off-by: Borislav Petkov <bp@suse.de>

Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>

Tested-by: Jamie Heilman <jamie@audible.transient.net>

Link: https://lore.kernel.org/r/YjGzJwjrvxg5YZ0Z@audible.transient.net

[Add a comment and a bit of safety checking, since this is going to be changed

 again for IBT support. - Paolo]

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

  [ bp: Backport only the fastop offset finding - the macros are largely

    simplified in

    79629181607e ("KVM: emulate: do not adjust size of fastop and setcc subroutines")

    so no need to backport pieces which will get removed anyway. ]

---

 arch/x86/kvm/emulate.c | 19 +++++++++++++++++--

 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c

index 5719d8cfdbd9..e86d610dc6b7 100644

--- a/arch/x86/kvm/emulate.c

+++ b/arch/x86/kvm/emulate.c

@@ -1047,7 +1062,7 @@ static int em_bsr_c(struct x86_emulate_ctxt *ctxt)

 static __always_inline u8 test_cc(unsigned int condition, unsigned long flags)

 {

 	u8 rc;

-	void (*fop)(void) = (void *)em_setcc + 4 * (condition & 0xf);

+	void (*fop)(void) = (void *)em_setcc + SETCC_ALIGN * (condition & 0xf);

 	flags = (flags & EFLAGS_MASK) | X86_EFLAGS_IF;

 	asm("push %[flags]; popf; " CALL_NOSPEC