From patchwork Tue Feb 21 18:49:08 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: KP Singh X-Patchwork-Id: 60221 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp174169wrd; Tue, 21 Feb 2023 11:03:16 -0800 (PST) X-Google-Smtp-Source: AK7set9vMNMilt2nTNmb6vvmQzuyTzLI+wpcr2ljm6p8PTv1b1+BGs/nelJoU1d55FHjTEeaEyG4 X-Received: by 2002:a17:906:494c:b0:879:6abe:915e with SMTP id f12-20020a170906494c00b008796abe915emr15456704ejt.69.1677006196358; Tue, 21 Feb 2023 11:03:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677006196; cv=none; d=google.com; s=arc-20160816; b=UDfr4OevxoplY4s3riqgEpvE68WYsu2Kl49B1av0Oov2UUyLkaXCB8hsa5oym5JUg+ DnunqqrU2k28JmX6OqODb8ruBIbOvr+PfCTncYdpHGpsbjbGkhHFrvwZy63Zw8aWCZMk ZAVPfmdBwDcl3EqNgIbQnfPlOYAUSL9AZqsl8bdFmJxSJrcJV5z8APIEeA5NquRlllw4 q23FbUrJQEmd47R6SbLAEHBQ7BFNNxvUm12MI9dzK06r4otV6PwxCPFuYDwbqw6+WLt4 MA4NUk6pBTei0IbsqJqEzB7hk0SWAu/kIyCeu2Z4o1jRftv3BJm8JMtBJHH3y+UsIO3h T/Pw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=L5SqzzAsA6dN2F6cOWs+N+ULkuplwVDqpdxe26A3nPU=; b=dGcRU0vLUN/fNQKij9BG8A0vQmvCoZM0FTbiR3J5xZAvLqOldOHJiSNJz1WF7NRLDd YwZhUOv8SCWS4X1s509ZwK667rM/T6FcCTotmK/to2j+UQSiMADFRWQy/3BIeFJDosVb CI9mIGO46Q7KU2BOMFsAOSg6TUYJQBYXjzLDR1ideFLKtTxb+/97yosMR/XaTtnQ+eCa dK+bxBx6Z88OZUIGPDwdpk5FC7hZeO4hVe86uGEctoiL7kK4TvXT1IKE0n+1Jo9IkD2k 8M64/ipXWMB/TFEQDYMMZuO8xjWoSBID1sGu6LdCBjwSQWZM/Tp8U6ZglDSIDXCPtwmX 34VQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=cuQrnBTM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id bp14-20020a170907918e00b008e45692b970si620540ejb.446.2023.02.21.11.02.52; Tue, 21 Feb 2023 11:03:16 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=cuQrnBTM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229984AbjBUStc (ORCPT + 99 others); Tue, 21 Feb 2023 13:49:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46794 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229535AbjBUSt2 (ORCPT ); Tue, 21 Feb 2023 13:49:28 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D91D22A6C4 for ; Tue, 21 Feb 2023 10:49:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7C920B8109D for ; Tue, 21 Feb 2023 18:49:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8665C433A0; Tue, 21 Feb 2023 18:49:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1677005364; bh=Pq1/EGne3LaGE8RJqGaU426y8oEgl4zvqIPCQIl6Ii8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cuQrnBTM6zmFnApUBUKl3tuyCnwcWoiMcvD6Jaj23nlDqxIUbYnYgaiL7M1s2pQVd RPbx/e2zE8SFaBuwFa063d5141E+dQcajNGtR12wlIMM+olITT6pFJ3bT0oJnizKRO JQWITQ/vklpjFWHvoNtVTNJeDPQB6/iwv+L3bcUbYMpbyBsr4VCEy0phVzL+lzcudy JvNU7qiNy38PQnnKIXaWGxLG6y+mOI5X47Lu0IQKAZ4C0Ti8R+G2tLRdOMj7pzuXrv w9BUJFnH/9QMvsXvOXR9VhEoIHSxGL7c7g9l+ib1keIJhRlBzC/wsZtu/bDOTg08fV wHd8CXxFNOlYw== From: KP Singh To: linux-kernel@vger.kernel.org Cc: pjt@google.com, evn@google.com, jpoimboe@kernel.org, tglx@linutronix.de, x86@kernel.org, hpa@zytor.com, peterz@infradead.org, pawan.kumar.gupta@linux.intel.com, kim.phillips@amd.com, alexandre.chartre@oracle.com, daniel.sneddon@linux.intel.com, corbet@lwn.net, bp@suse.de, linyujun809@huawei.com, kpsingh@kernel.org, jmattson@google.com Subject: [PATCH v2 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP Date: Tue, 21 Feb 2023 19:49:08 +0100 Message-Id: <20230221184908.2349578-2-kpsingh@kernel.org> X-Mailer: git-send-email 2.39.2.637.g21b0678d19-goog In-Reply-To: <20230221184908.2349578-1-kpsingh@kernel.org> References: <20230221184908.2349578-1-kpsingh@kernel.org> MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1758468449346053687?= X-GMAIL-MSGID: =?utf-8?q?1758468449346053687?= Explain why STIBP is needed with legacy IBRS as currently implemented (KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled. Signed-off-by: KP Singh --- Documentation/admin-guide/hw-vuln/spectre.rst | 22 ++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst index c4dcdb3d0d45..e193ee13dc9a 100644 --- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -479,8 +479,17 @@ Spectre variant 2 On Intel Skylake-era systems the mitigation covers most, but not all, cases. See :ref:`[3] ` for more details. - On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced - IBRS on x86), retpoline is automatically disabled at run time. + On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS + or enhanced IBRS on x86), retpoline is automatically disabled at run time. + + Setting the IBRS bit implicitly enables STIBP which guards against + cross-thread branch target injection on SMT systems. On systems with enhanced + IBRS, the kernel sets the bit once, which keeps cross-thread protections + always enabled, obviating the need for an explicit STIBP. On CPUs with legacy + IBRS, the kernel clears the IBRS bit on returning to user-space, thus also + disabling the implicit STIBP. Consequently, STIBP needs to be explicitly + enabled to guard against cross-thread attacks in userspace. + The retpoline mitigation is turned on by default on vulnerable CPUs. It can be forced on or off by the administrator @@ -504,9 +513,12 @@ Spectre variant 2 For Spectre variant 2 mitigation, individual user programs can be compiled with return trampolines for indirect branches. This protects them from consuming poisoned entries in the branch - target buffer left by malicious software. Alternatively, the - programs can disable their indirect branch speculation via prctl() - (See :ref:`Documentation/userspace-api/spec_ctrl.rst `). + target buffer left by malicious software. + + On legacy IBRS systems, at return to userspace, implicit STIBP is disabled + because the kernel clears the IBRS bit. In this case, the userspace programs + can disable indirect branch speculation via prctl() (See + :ref:`Documentation/userspace-api/spec_ctrl.rst `). On x86, this will turn on STIBP to guard against attacks from the sibling thread when the user program is running, and use IBPB to flush the branch target buffer when switching to/from the program.