• Michael Ellerman's avatar
    powerpc/book3s64: Fix link stack flush on context switch · 39e72bf9
    Michael Ellerman authored
    In commit ee13cb24 ("powerpc/64s: Add support for software count
    cache flush"), I added support for software to flush the count
    cache (indirect branch cache) on context switch if firmware told us
    that was the required mitigation for Spectre v2.
    
    As part of that code we also added a software flush of the link
    stack (return address stack), which protects against Spectre-RSB
    between user processes.
    
    That is all correct for CPUs that activate that mitigation, which is
    currently Power9 Nimbus DD2.3.
    
    What I got wrong is that on older CPUs, where firmware has disabled
    the count cache, we also need to flush the link stack on context
    switch.
    
    To fix it we create a new feature bit which is not set by firmware,
    which tells us we need to flush the link stack. We set that when
    firmware tells us that either of the existing Spectre v2 mitigations
    are enabled.
    
    Then we adjust the patching code so that if we see that feature bit we
    enable the link stack flush. If we're also told to flush the count
    cache in software then we fall through and do that also.
    
    On the older CPUs we don't need to do do the software count cache
    flush, firmware has disabled it, so in that case we patch in an early
    return after the link stack flush.
    
    The naming of some of the functions is awkward after this patch,
    because they're called "count cache" but they also do link stack. But
    we'll fix that up in a later commit to ease backporting.
    
    This is the fix for CVE-2019-18660.
    Reported-by: default avatarAnthony Steinhauser <asteinhauser@google.com>
    Fixes: ee13cb24 ("powerpc/64s: Add support for software count cache flush")
    Cc: stable@vger.kernel.org # v4.4+
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    39e72bf9
entry_64.S 31.8 KB