From patchwork Mon Feb 27 06:05:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: KP Singh X-Patchwork-Id: 61747 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp2260830wrd; Sun, 26 Feb 2023 22:24:19 -0800 (PST) X-Google-Smtp-Source: AK7set9j7k4q9xbK6AhjQAm6gpL4zPdUnXaGn7hg2q5nsiUvDpR6vF/qRe62NRUpxe+9tr3pJrYn X-Received: by 2002:a17:906:4910:b0:8b1:7de0:c854 with SMTP id b16-20020a170906491000b008b17de0c854mr31594852ejq.41.1677479059068; Sun, 26 Feb 2023 22:24:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677479059; cv=none; d=google.com; s=arc-20160816; b=KZLPnwm3uPaLK39sTsFikB6IEdsIex0z4tYEgkBQ4TkcX1G5i00l8NFM9T5nY/ohEi Z47tpThACTF8XiY1A9ezO7CP2ylOSA4IvZRBqpZ6j2p73thJZ1I2m4jVJb/ocIKwN4xj xcVaEPKwyo3YiB0mU00AFvJcidWEHJ+pC/5U/KDL6oDxVe6vGiv6cHfCX6uoXbWeNRLw rIOF3+fKFI/0hFueLHyzhMlJubiWachBIZ861TIeOPRtgYE6nyZLfH/drfw26RJB6vo3 PUhmvHh+AblIKp6NK4CcNnh0XeLVkX87FuB1cp//ZigzkKU/Hi2RoirV5+I6Dfz1XPyP rEJA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=wAyTg2QrmokCQ5lPnSScFYzbdBwYlRxyupYDW9vxNz4=; b=rykUMlpwYA7Mh/undUzBVvpK6qRoj5NOvl4zDhPu60f8NGzoB4zxikcW3QgAVkR1Zg FVG3HYuY0cKw403Twl4eIh6t0zoOpHGIsoBQu+g50huH9olihURtrb4iE+0WeIBPEBmo M+hLI4Q7wpKCWRE/GRYJcvXZPVKXj2gx1ct+I/zLp5Pq9XNok7QuU3r4Dc/352mxgAmt ZcYADJ1Gvu4/U7/4UK2JAVsjPLlwbV7RANduqLxmWjPVpO3eD/5o3DEVXLKeiPI9RcQp Ek+jXQWd0SIi3+l0meIOcuorHwWGwAsZWqwUkbnZEZgd6kUlFxhht/9uFu9NDhnTz6FK v52A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=NBrJCXUq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id b1-20020a17090630c100b008ce03a3825csi7420215ejb.258.2023.02.26.22.23.55; Sun, 26 Feb 2023 22:24:19 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=NBrJCXUq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229697AbjB0GGe (ORCPT + 99 others); Mon, 27 Feb 2023 01:06:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52086 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229657AbjB0GGd (ORCPT ); Mon, 27 Feb 2023 01:06:33 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 644DBE07A; Sun, 26 Feb 2023 22:06:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8F4DCB80CA9; Mon, 27 Feb 2023 06:05:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6AE05C433A0; Mon, 27 Feb 2023 06:05:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1677477954; bh=4C1+pvBIASG8iiG2GF0aay0fnKavFG+MLuc1joZcqJI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NBrJCXUqgCf09EB5BvwGub/rHwbP+qS/KsQMfoKVAY6BOsh/xJK/x3pnCGYgmvqW5 J4xHtWgvcxkua5CWg0lCPIuAHedO0RPFyd3TDHBFciORg2iNu2XrDdX2wadlEjaNMQ pYL/WS7hWKsUojenUJOHLzVSzueBYOA8vUGDG4ep/ye3cCNKsF8n18QkTJ7d0dE52U KjU+Zyqf54PAsUFWdh0neztl4So/qAR7bAWzKojzzI5eUIJVV38VBHjI5P0jquNAB7 AXKGr//PXDfKgPZpgNlB2+fDnNlUBj6PA0hHUhmcy6jMffdw0f0SiCDTnS/pyMAskR pRpplp8d8rmjw== From: KP Singh To: linux-kernel@vger.kernel.org Cc: pjt@google.com, evn@google.com, jpoimboe@kernel.org, tglx@linutronix.de, x86@kernel.org, hpa@zytor.com, peterz@infradead.org, pawan.kumar.gupta@linux.intel.com, kim.phillips@amd.com, alexandre.chartre@oracle.com, daniel.sneddon@linux.intel.com, corbet@lwn.net, bp@suse.de, linyujun809@huawei.com, kpsingh@kernel.org, jmattson@google.com, mingo@redhat.com, seanjc@google.com, andrew.cooper3@citrix.com, stable@vger.kernel.org Subject: [PATCH v3 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP Date: Mon, 27 Feb 2023 07:05:41 +0100 Message-Id: <20230227060541.1939092-2-kpsingh@kernel.org> X-Mailer: git-send-email 2.39.2.637.g21b0678d19-goog In-Reply-To: <20230227060541.1939092-1-kpsingh@kernel.org> References: <20230227060541.1939092-1-kpsingh@kernel.org> MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1758964282111023741?= X-GMAIL-MSGID: =?utf-8?q?1758964282111023741?= Explain why STIBP is needed with legacy IBRS as currently implemented (KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled. Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") Cc: stable@vger.kernel.org Signed-off-by: KP Singh --- Documentation/admin-guide/hw-vuln/spectre.rst | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst index 3fe6511c5405..4d186f599d90 100644 --- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -479,8 +479,16 @@ Spectre variant 2 On Intel Skylake-era systems the mitigation covers most, but not all, cases. See :ref:`[3] ` for more details. - On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced - IBRS on x86), retpoline is automatically disabled at run time. + On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS + or enhanced IBRS on x86), retpoline is automatically disabled at run time. + + Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at + boot, by setting the IBRS bit, and they're automatically protected against + Spectre v2 variant attacks, including cross-thread branch target injections + on SMT systems (STIBP). In other words, eIBRS enables STIBP too. + + Legacy IBRS systems clear the IBRS bit on exit to userspace and + therefore explicitly enable STIBP for that The retpoline mitigation is turned on by default on vulnerable CPUs. It can be forced on or off by the administrator @@ -504,9 +512,12 @@ Spectre variant 2 For Spectre variant 2 mitigation, individual user programs can be compiled with return trampolines for indirect branches. This protects them from consuming poisoned entries in the branch - target buffer left by malicious software. Alternatively, the - programs can disable their indirect branch speculation via prctl() - (See :ref:`Documentation/userspace-api/spec_ctrl.rst `). + target buffer left by malicious software. + + On legacy IBRS systems, at return to userspace, implicit STIBP is disabled + because the kernel clears the IBRS bit. In this case, the userspace programs + can disable indirect branch speculation via prctl() (See + :ref:`Documentation/userspace-api/spec_ctrl.rst `). On x86, this will turn on STIBP to guard against attacks from the sibling thread when the user program is running, and use IBPB to flush the branch target buffer when switching to/from the program.