Commit 864bcaa3 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Borislav Petkov (AMD)
Browse files

x86/cpu/kvm: Provide UNTRAIN_RET_VM 



Similar to how it doesn't make sense to have UNTRAIN_RET have two
untrain calls, it also doesn't make sense for VMEXIT to have an extra
IBPB call.

This cures VMEXIT doing potentially unret+IBPB or double IBPB.
Also, the (SEV) VMEXIT case seems to have been overlooked.

Redefine the meaning of the synthetic IBPB flags to:

 - ENTRY_IBPB     -- issue IBPB on entry  (was: entry + VMEXIT)
 - IBPB_ON_VMEXIT -- issue IBPB on VMEXIT

And have 'retbleed=ibpb' set *BOTH* feature flags to ensure it retains
the previous behaviour and issues IBPB on entry+VMEXIT.

The new 'srso=ibpb_vmexit' option only sets IBPB_ON_VMEXIT.

Create UNTRAIN_RET_VM specifically for the VMEXIT case, and have that
check IBPB_ON_VMEXIT.

All this avoids having the VMEXIT case having to check both ENTRY_IBPB
and IBPB_ON_VMEXIT and simplifies the alternatives.

Fixes: fb3bd914 ("x86/srso: Add a Speculative RAS Overflow mitigation")
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121149.109557833@infradead.org
parent e7c25c44

arch/x86/include/asm/nospec-branch.h

+11 −0
Original line number Diff line number Diff line
@@ -299,6 +299,17 @@ 
#endif

.endm



.macro UNTRAIN_RET_VM

#if defined(CONFIG_CPU_UNRET_ENTRY) || defined(CONFIG_CPU_IBPB_ENTRY) || \

	defined(CONFIG_CALL_DEPTH_TRACKING) || defined(CONFIG_CPU_SRSO)

	VALIDATE_UNRET_END

	ALTERNATIVE_3 "",						\

		      CALL_UNTRAIN_RET, X86_FEATURE_UNRET,		\

		      "call entry_ibpb", X86_FEATURE_IBPB_ON_VMEXIT,	\

		      __stringify(RESET_CALL_DEPTH), X86_FEATURE_CALL_DEPTH

#endif

.endm



.macro UNTRAIN_RET_FROM_CALL

#if defined(CONFIG_CPU_UNRET_ENTRY) || defined(CONFIG_CPU_IBPB_ENTRY) || \

	defined(CONFIG_CALL_DEPTH_TRACKING)

arch/x86/kernel/cpu/bugs.c

+1 −0
Original line number Diff line number Diff line
@@ -1054,6 +1054,7 @@ static void __init retbleed_select_mitigation(void) 


	case RETBLEED_MITIGATION_IBPB:

		setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);

		setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);

		mitigate_smt = true;

		break;

arch/x86/kvm/svm/vmenter.S

+2 −5
Original line number Diff line number Diff line
@@ -222,10 +222,7 @@ SYM_FUNC_START(__svm_vcpu_run) 
	 * because interrupt handlers won't sanitize 'ret' if the return is

	 * from the kernel.

	 */

	UNTRAIN_RET



	/* SRSO */

	ALTERNATIVE "", "call entry_ibpb", X86_FEATURE_IBPB_ON_VMEXIT

	UNTRAIN_RET_VM



	/*

	 * Clear all general purpose registers except RSP and RAX to prevent
@@ -362,7 +359,7 @@ SYM_FUNC_START(__svm_sev_es_vcpu_run) 
	 * because interrupt handlers won't sanitize RET if the return is

	 * from the kernel.

	 */

	UNTRAIN_RET

	UNTRAIN_RET_VM



	/* "Pop" @spec_ctrl_intercepted.  */

	pop %_ASM_BX