From: Peter Zijlstra <peterz@infradead.org>

Date: Tue, 14 Jun 2022 23:15:53 +0200

Subject: x86/entry: Add kernel IBRS implementation

Git-commit: 2dbb887e875b1de3ca8f40ddf26bcfe55798c609

Patch-mainline: v5.19-rc7

References: bsc#1199657 CVE-2022-29900 CVE-2022-29901

Implement Kernel IBRS - currently the only known option to mitigate RSB

underflow speculation issues on Skylake hardware.

Note: since IBRS_ENTER requires fuller context established than

UNTRAIN_RET, it must be placed after it. However, since UNTRAIN_RET

itself implies a RET, it must come after IBRS_ENTER. This means

IBRS_ENTER needs to also move UNTRAIN_RET.

Note 2: KERNEL_IBRS is sub-optimal for XenPV.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>

Signed-off-by: Borislav Petkov <bp@suse.de>

Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>

Signed-off-by: Borislav Petkov <bp@suse.de>

---

 arch/x86/entry/calling.h           |   58 +++++++++++++++++++++++++++++++++++++

 arch/x86/entry/entry_64.S          |   41 ++++++++++++++++++++++++--

 arch/x86/entry/entry_64_compat.S   |   12 +++++--

 arch/x86/include/asm/cpufeatures.h |    2 -

 4 files changed, 106 insertions(+), 7 deletions(-)

--- a/arch/x86/entry/calling.h

+++ b/arch/x86/entry/calling.h

@@ -5,6 +5,8 @@

 #include <asm/percpu.h>

 #include <asm/asm-offsets.h>

 #include <asm/processor-flags.h>

+#include <asm/msr.h>

+#include <asm/nospec-branch.h>

 /*

@@ -336,6 +338,62 @@ For 32-bit we have the following convent

 #endif

 /*

+ * IBRS kernel mitigation for Spectre_v2.

+ *

+ * Assumes full context is established (PUSH_REGS, CR3 and GS) and it clobbers

+ * the regs it uses (AX, CX, DX). Must be called before the first RET

+ * instruction (NOTE! UNTRAIN_RET includes a RET instruction)

+ *

+ * The optional argument is used to save/restore the current value,

+ * which is used on the paranoid paths.

+ *

+ * Assumes x86_spec_ctrl_{base,current} to have SPEC_CTRL_IBRS set.

+ */

+.macro IBRS_ENTER save_reg

+	ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_KERNEL_IBRS

+	movl	$MSR_IA32_SPEC_CTRL, %ecx

+

+.ifnb \save_reg

+	rdmsr

+	shl	$32, %rdx

+	or	%rdx, %rax

+	mov	%rax, \save_reg

+	test	$SPEC_CTRL_IBRS, %eax

+	jz	.Ldo_wrmsr_\@

+	lfence

+	jmp	.Lend_\@

+.Ldo_wrmsr_\@:

+.endif

+

+	movq	PER_CPU_VAR(x86_spec_ctrl_current), %rdx

+	movl	%edx, %eax

+	shr	$32, %rdx

+	wrmsr

+.Lend_\@:

+.endm

+

+/*

+ * Similar to IBRS_ENTER, requires KERNEL GS,CR3 and clobbers (AX, CX, DX)

+ * regs. Must be called after the last RET.

+ */

+.macro IBRS_EXIT save_reg

+	ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_KERNEL_IBRS

+	movl	$MSR_IA32_SPEC_CTRL, %ecx

+

+.ifnb \save_reg

+	mov	\save_reg, %rdx

+.else

+	movq	PER_CPU_VAR(x86_spec_ctrl_current), %rdx

+	andl	$(~SPEC_CTRL_IBRS), %edx

+.endif

+

+	movl	%edx, %eax

+	shr	$32, %rdx

+	wrmsr

+.Lend_\@:

+.endm

+

+/*

  * Mitigate Spectre v1 for conditional swapgs code paths.

  *

  * FENCE_SWAPGS_USER_ENTRY is used in the user entry swapgs code path, to

--- a/arch/x86/entry/entry_64_compat.S

+++ b/arch/x86/entry/entry_64_compat.S

@@ -3,7 +3,6 @@

  *

  * Copyright 2000-2002 Andi Kleen, SuSE Labs.

  */

-#include "calling.h"

 #include <asm/asm-offsets.h>

 #include <asm/current.h>

 #include <asm/errno.h>

@@ -17,6 +16,8 @@

 #include <linux/linkage.h>

 #include <linux/err.h>

+#include "calling.h"

+

 	.section .entry.text, "ax"

 /*

@@ -106,6 +107,7 @@ ENTRY(entry_SYSENTER_compat)

 	xorl	%r15d, %r15d		/* nospec   r15 */

 	cld

+	IBRS_ENTER

 	UNTRAIN_RET

 	/*

@@ -252,6 +254,9 @@ GLOBAL(entry_SYSCALL_compat_after_hwfram

 	 */

 	TRACE_IRQS_OFF

+	IBRS_ENTER

+	UNTRAIN_RET

+

 	movq	%rsp, %rdi

 	call	do_fast_syscall_32

 	/* XEN PV guests always use IRET path */

@@ -261,6 +266,8 @@ GLOBAL(entry_SYSCALL_compat_after_hwfram

 	/* Opportunistic SYSRET */

 sysret32_from_system_call:

 	TRACE_IRQS_ON			/* User mode traces as IRQs on. */

+	IBRS_EXIT

+

 	movq	RBX(%rsp), %rbx		/* pt_regs->rbx */

 	movq	RBP(%rsp), %rbp		/* pt_regs->rbp */

 	movq	EFLAGS(%rsp), %r11	/* pt_regs->flags (in r11) */

@@ -321,8 +328,6 @@ ENTRY(switch_to_thread_stack_compat)

 	ALTERNATIVE "movq %rsp, %rdi", "jmp .Lcompat_keep_stack", X86_FEATURE_XENPV

 	movq    %rsp, %rdi

 	movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp

-	/* Restrict Indirect Branch Speculation */

-	RESTRICT_IB_SPEC

 	UNWIND_HINT sp_offset=16 sp_reg=ORC_REG_DI

 	pushq   7*8(%rdi)		/* regs->ss */

@@ -419,6 +424,7 @@ ENTRY(entry_INT80_compat)

 	 */

 	TRACE_IRQS_OFF

+	IBRS_ENTER

 	UNTRAIN_RET

 	movq	%rsp, %rdi

--- a/arch/x86/entry/entry_64.S

+++ b/arch/x86/entry/entry_64.S

@@ -230,6 +230,8 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)

 	/* IRQs are off. */

 	movq	%rsp, %rdi

+	/* clobbers %rax, make sure it is after saving the syscall nr */

+	IBRS_ENTER

 	UNTRAIN_RET

 	call	do_syscall_64		/* returns with IRQs disabled */

@@ -302,6 +304,7 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)

 	 * perf profiles. Nothing jumps here.

 	 */

 syscall_return_via_sysret:

+	IBRS_EXIT

 	POP_REGS pop_rdi=0

 	/*

@@ -554,6 +557,9 @@ END(irq_entries_start)

 	 */

 	TRACE_IRQS_OFF

+	IBRS_ENTER

+	UNTRAIN_RET

+

 	CALL_enter_from_user_mode

 1:

@@ -590,6 +596,7 @@ GLOBAL(retint_user)

 	TRACE_IRQS_IRETQ

 GLOBAL(swapgs_restore_regs_and_return_to_usermode)

+	IBRS_EXIT

 #ifdef CONFIG_DEBUG_ENTRY

 	/* Assert that pt_regs indicates user mode. */

 	testb	$3, CS(%rsp)

@@ -1160,6 +1167,8 @@ idtentry machine_check		do_mce			has_err

  * Save all registers in pt_regs, and switch gs if needed.

  * Use slow, but surefire "are we in kernel?" check.

  * Return: ebx=0: need swapgs on exit, ebx=1: otherwise

+ * R14 - old CR3

+ * R15 - old SPEC_CTRL

  */

 ENTRY(paranoid_entry)

 	UNWIND_HINT_FUNC

@@ -1173,7 +1182,6 @@ ENTRY(paranoid_entry)

 	js	1f				/* negative -> in kernel */

 	SWAPGS

 	xorl	%ebx, %ebx

-

 1:

 	SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg=%rax save_reg=%r14

 	/*

@@ -1183,7 +1191,14 @@ ENTRY(paranoid_entry)

 	 */

 	FENCE_SWAPGS_KERNEL_ENTRY

-	ret

+	/*

+	 * Once we have CR3 and %GS setup save and set SPEC_CTRL. Just like

+	 * CR3 above, keep the old value in a callee saved register.

+	 */

+	IBRS_ENTER save_reg=%r15

+	UNTRAIN_RET

+

+	RET

 END(paranoid_entry)

 /*

@@ -1197,9 +1212,19 @@ END(paranoid_entry)

  * to try to handle preemption here.

  *

  * On entry, ebx is "no swapgs" flag (1: don't need swapgs, 0: need it)

+ *

+ * R14 - old CR3

+ * R15 - old SPEC_CTRL

  */

 ENTRY(paranoid_exit)

 	UNWIND_HINT_REGS

+

+	/*

+	 * Must restore IBRS state before both CR3 and %GS since we need access

+	 * to the per-CPU x86_spec_ctrl_shadow variable.

+	 */

+	IBRS_EXIT save_reg=%r15

+

 	DISABLE_INTERRUPTS(CLBR_ANY)

 	TRACE_IRQS_OFF_DEBUG

 	testl	%ebx, %ebx			/* swapgs needed? */

@@ -1234,9 +1259,11 @@ ENTRY(error_entry)

 	FENCE_SWAPGS_USER_ENTRY

 	/* We have user CR3.  Change to kernel CR3. */

 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax

+	IBRS_ENTER

 	UNTRAIN_RET

 .Lerror_entry_from_usermode_after_swapgs:

+

 	/* Put us onto the real thread stack. */

 	popq	%r12				/* save return addr in %12 */

 	movq	%rsp, %rdi			/* arg0 = pt_regs pointer */

@@ -1284,6 +1311,7 @@ ENTRY(error_entry)

 	SWAPGS

 	FENCE_SWAPGS_USER_ENTRY

 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax

+	IBRS_ENTER

 	UNTRAIN_RET

 	jmp .Lerror_entry_done

@@ -1300,6 +1328,8 @@ ENTRY(error_entry)

 	SWAPGS

 	FENCE_SWAPGS_USER_ENTRY

 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax

+	IBRS_ENTER

+	UNTRAIN_RET

 	/*

 	 * Pretend that the exception came from user mode: set up pt_regs

@@ -1376,7 +1406,6 @@ ENTRY(nmi)

 	testb	$3, CS-RIP+8(%rsp)

 	jz	.Lnmi_from_kernel

-	UNTRAIN_RET

 	/*

 	 * NMI from user mode.  We need to run on the thread stack, but we

@@ -1406,6 +1435,9 @@ ENTRY(nmi)

 	PUSH_AND_CLEAR_REGS rdx=(%rdx)

 	ENCODE_FRAME_POINTER

+	IBRS_ENTER

+	UNTRAIN_RET

+

 	/*

 	 * At this point we no longer need to worry about stack damage

 	 * due to nesting -- we're on the normal thread stack and we're

@@ -1629,6 +1661,9 @@ end_repeat_nmi:

 	movq	$-1, %rsi

 	call	do_nmi

+	/* Always restore stashed SPEC_CTRL value (see paranoid_entry) */

+	IBRS_EXIT save_reg=%r15

+

 	RESTORE_CR3 scratch_reg=%r15 save_reg=%r14

 	testl	%ebx, %ebx			/* swapgs needed? */

--- a/arch/x86/include/asm/cpufeatures.h

+++ b/arch/x86/include/asm/cpufeatures.h

@@ -203,7 +203,7 @@

 #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */

 #define X86_FEATURE_SME		( 7*32+10) /* AMD Secure Memory Encryption */

 #define X86_FEATURE_PTI			( 7*32+11) /* Kernel Page Table Isolation enabled */

-/* FREE!				( 7*32+12) */

+#define X86_FEATURE_KERNEL_IBRS		( 7*32+12) /* "" Set/clear IBRS on kernel entry/exit */

 /* FREE!				( 7*32+13) */

 #define X86_FEATURE_INTEL_PPIN	( 7*32+14) /* Intel Processor Inventory Number */

 #define X86_FEATURE_CDP_L2		( 7*32+15) /* Code and Data Prioritization L2 */