From patchwork Mon Feb 27 06:05:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: KP Singh X-Patchwork-Id: 61746 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp2257427wrd; Sun, 26 Feb 2023 22:11:49 -0800 (PST) X-Google-Smtp-Source: AK7set9lWoVkdXCTkFbAlumkEdPTE+O009eq04O4CMIE47sUE6tubftd4Q4mBaXSYf7GZDmhqMg8 X-Received: by 2002:a17:907:6f0e:b0:8f9:ed75:f962 with SMTP id sy14-20020a1709076f0e00b008f9ed75f962mr7113203ejc.18.1677478308849; Sun, 26 Feb 2023 22:11:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677478308; cv=none; d=google.com; s=arc-20160816; b=RrevPZeyfnQthe+ZMDdlwyStf5shlxl1KHeKJSuIp48ahtmunvGWYEdJx2NHfxDW+W mqcgGcwW7ToJ2NknO34LaCLdL9R/D4i1wWknqQcT5u+rSB1hp7LUYLiZputa/cxgmL0Y vp7/GzNoDrkeqKG1zeRb+R6AmgrJ7cqMICbwyFzVZXiU5x1+vjO/uVcK5VtWqF3+M9Ae ITNbMvlaSmGTaGZcurzn7P87reFqh9T0q+8XH/fToB6nRTeQWucTjFsSyO2q96mkSP95 L01BNeEZplTwLac+003wooj3pMnegmc7IcxQbBV+nHEcx6zRC+hDmj/yhCXf6XrhdVHN KxfQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=rXG+4tDlnpkprAFqJWp6ymhCrQ+HrcGd4Lbj6QOLBZc=; b=sGsZKClbgR2PF1Kl0RVA/1+6P+v6kjOizyQ8gIE9nx/rqdpIa5ozXEb9/xUpVb5TDh GQpDwp8j06+aBpq5rr9BCM9bxMWaKwoOAHowAzokfOLEGc7TN0FLerVsE/BCPHqut+pq ClE3e6FnLAU0ywdmgKCX6A8NV+YpEu+4jW1666QEDSD1hwMDeBPXTDx/u8qjWIaCc12F OIVl69MH4hba2QKUSgIEHD0qDgPaqFb5eoQS0Pt1UQ8aMLL3Y3TSJzYj3LYD/ffqnPli +6klzVhICOWqW29yMhgvoUlknULrog1AB5txDnNrTVb6Q62t5yKldQ4NHP+zqlP41fzK PLFA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=uiukTXf5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d21-20020aa7d695000000b004a235a340ebsi92464edr.163.2023.02.26.22.11.26; Sun, 26 Feb 2023 22:11:48 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=uiukTXf5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229607AbjB0GG1 (ORCPT + 99 others); Mon, 27 Feb 2023 01:06:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229451AbjB0GG0 (ORCPT ); Mon, 27 Feb 2023 01:06:26 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 556F71ACD9; Sun, 26 Feb 2023 22:05:54 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 916AB60D37; Mon, 27 Feb 2023 06:05:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB735C433D2; Mon, 27 Feb 2023 06:05:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1677477950; bh=icm2m5El5AGMcBFNrF6OIbUMMImdYobl9YWfSty+WDI=; h=From:To:Cc:Subject:Date:From; b=uiukTXf50Z10gMx0TfsLNkXq5c7BA7TcoIcZ4k2eG8KqMTZcsfJfksBh00ZHoiyX9 jMWqCf4x5ovnNtJJSSWAOSPtMJnLG5pUuuPBGmNFbb02SvGAemHhIeBWhd65EY8bwt ew1xyy8esBj/sPHZoSmi7dSs3PwGY4oC4XXyjns/ctGJa8KI/eyrGONZ8vcCWuGW+o 8pDGVgu/VaOKXaNCnl4L2eXnvYW9Z2hhxI/rYHEFcs6rfU9QcCq2gulTBQpPNZmlPr kMXhuZpkjWh0dDu3ImPAVs9jhP8nuvF3kSWImArjAJk+IU3mbi5uH25DZkcxkniRf8 EsIXGbadCxNAg== From: KP Singh To: linux-kernel@vger.kernel.org Cc: pjt@google.com, evn@google.com, jpoimboe@kernel.org, tglx@linutronix.de, x86@kernel.org, hpa@zytor.com, peterz@infradead.org, pawan.kumar.gupta@linux.intel.com, kim.phillips@amd.com, alexandre.chartre@oracle.com, daniel.sneddon@linux.intel.com, corbet@lwn.net, bp@suse.de, linyujun809@huawei.com, kpsingh@kernel.org, jmattson@google.com, mingo@redhat.com, seanjc@google.com, andrew.cooper3@citrix.com, =?utf-8?q?J?= =?utf-8?q?os=C3=A9_Oliveira?= , Rodrigo Branco , stable@vger.kernel.org Subject: [PATCH v3 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS Date: Mon, 27 Feb 2023 07:05:40 +0100 Message-Id: <20230227060541.1939092-1-kpsingh@kernel.org> X-Mailer: git-send-email 2.39.2.637.g21b0678d19-goog MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1758963494778661874?= X-GMAIL-MSGID: =?utf-8?q?1758963494778661874?= When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation() determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for enabling STIBP (through seccomp/prctl() by default or always-on, if selected by spectre_v2_user kernel cmdline parameter). Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") Reported-by: José Oliveira Reported-by: Rodrigo Branco Cc: stable@vger.kernel.org Signed-off-by: KP Singh --- arch/x86/kernel/cpu/bugs.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index cf81848b72f4..44e22cda7fb3 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1133,14 +1133,18 @@ spectre_v2_parse_user_cmdline(void) return SPECTRE_V2_USER_CMD_AUTO; } -static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) +static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode) { - return mode == SPECTRE_V2_IBRS || - mode == SPECTRE_V2_EIBRS || + return mode == SPECTRE_V2_EIBRS || mode == SPECTRE_V2_EIBRS_RETPOLINE || mode == SPECTRE_V2_EIBRS_LFENCE; } +static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) +{ + return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS; +} + static void __init spectre_v2_user_select_mitigation(void) { @@ -1203,12 +1207,20 @@ spectre_v2_user_select_mitigation(void) } /* - * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible, - * STIBP is not required. + * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP + * is not required. + * + * Enhanced IBRS also protects against cross-thread branch target + * injection in user-mode as the IBRS bit remains always set which + * implicitly enables cross-thread protections. However, in legacy IBRS + * mode, the IBRS bit is set only on kernel entry and cleared on return + * to userspace. This disables the implicit + * cross-thread protection, so allow for STIBP to be selected in that + * case. */ if (!boot_cpu_has(X86_FEATURE_STIBP) || !smt_possible || - spectre_v2_in_ibrs_mode(spectre_v2_enabled)) + spectre_v2_in_eibrs_mode(spectre_v2_enabled)) return; /* @@ -2340,7 +2352,7 @@ static ssize_t mmio_stale_data_show_state(char *buf) static char *stibp_state(void) { - if (spectre_v2_in_ibrs_mode(spectre_v2_enabled)) + if (spectre_v2_in_eibrs_mode(spectre_v2_enabled)) return ""; switch (spectre_v2_user_stibp) { From patchwork Mon Feb 27 06:05:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: KP Singh X-Patchwork-Id: 61747 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp2260830wrd; Sun, 26 Feb 2023 22:24:19 -0800 (PST) X-Google-Smtp-Source: AK7set9j7k4q9xbK6AhjQAm6gpL4zPdUnXaGn7hg2q5nsiUvDpR6vF/qRe62NRUpxe+9tr3pJrYn X-Received: by 2002:a17:906:4910:b0:8b1:7de0:c854 with SMTP id b16-20020a170906491000b008b17de0c854mr31594852ejq.41.1677479059068; Sun, 26 Feb 2023 22:24:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677479059; cv=none; d=google.com; s=arc-20160816; b=KZLPnwm3uPaLK39sTsFikB6IEdsIex0z4tYEgkBQ4TkcX1G5i00l8NFM9T5nY/ohEi Z47tpThACTF8XiY1A9ezO7CP2ylOSA4IvZRBqpZ6j2p73thJZ1I2m4jVJb/ocIKwN4xj xcVaEPKwyo3YiB0mU00AFvJcidWEHJ+pC/5U/KDL6oDxVe6vGiv6cHfCX6uoXbWeNRLw rIOF3+fKFI/0hFueLHyzhMlJubiWachBIZ861TIeOPRtgYE6nyZLfH/drfw26RJB6vo3 PUhmvHh+AblIKp6NK4CcNnh0XeLVkX87FuB1cp//ZigzkKU/Hi2RoirV5+I6Dfz1XPyP rEJA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=wAyTg2QrmokCQ5lPnSScFYzbdBwYlRxyupYDW9vxNz4=; b=rykUMlpwYA7Mh/undUzBVvpK6qRoj5NOvl4zDhPu60f8NGzoB4zxikcW3QgAVkR1Zg FVG3HYuY0cKw403Twl4eIh6t0zoOpHGIsoBQu+g50huH9olihURtrb4iE+0WeIBPEBmo M+hLI4Q7wpKCWRE/GRYJcvXZPVKXj2gx1ct+I/zLp5Pq9XNok7QuU3r4Dc/352mxgAmt ZcYADJ1Gvu4/U7/4UK2JAVsjPLlwbV7RANduqLxmWjPVpO3eD/5o3DEVXLKeiPI9RcQp Ek+jXQWd0SIi3+l0meIOcuorHwWGwAsZWqwUkbnZEZgd6kUlFxhht/9uFu9NDhnTz6FK v52A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=NBrJCXUq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id b1-20020a17090630c100b008ce03a3825csi7420215ejb.258.2023.02.26.22.23.55; Sun, 26 Feb 2023 22:24:19 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=NBrJCXUq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229697AbjB0GGe (ORCPT + 99 others); Mon, 27 Feb 2023 01:06:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52086 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229657AbjB0GGd (ORCPT ); Mon, 27 Feb 2023 01:06:33 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 644DBE07A; Sun, 26 Feb 2023 22:06:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8F4DCB80CA9; Mon, 27 Feb 2023 06:05:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6AE05C433A0; Mon, 27 Feb 2023 06:05:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1677477954; bh=4C1+pvBIASG8iiG2GF0aay0fnKavFG+MLuc1joZcqJI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NBrJCXUqgCf09EB5BvwGub/rHwbP+qS/KsQMfoKVAY6BOsh/xJK/x3pnCGYgmvqW5 J4xHtWgvcxkua5CWg0lCPIuAHedO0RPFyd3TDHBFciORg2iNu2XrDdX2wadlEjaNMQ pYL/WS7hWKsUojenUJOHLzVSzueBYOA8vUGDG4ep/ye3cCNKsF8n18QkTJ7d0dE52U KjU+Zyqf54PAsUFWdh0neztl4So/qAR7bAWzKojzzI5eUIJVV38VBHjI5P0jquNAB7 AXKGr//PXDfKgPZpgNlB2+fDnNlUBj6PA0hHUhmcy6jMffdw0f0SiCDTnS/pyMAskR pRpplp8d8rmjw== From: KP Singh To: linux-kernel@vger.kernel.org Cc: pjt@google.com, evn@google.com, jpoimboe@kernel.org, tglx@linutronix.de, x86@kernel.org, hpa@zytor.com, peterz@infradead.org, pawan.kumar.gupta@linux.intel.com, kim.phillips@amd.com, alexandre.chartre@oracle.com, daniel.sneddon@linux.intel.com, corbet@lwn.net, bp@suse.de, linyujun809@huawei.com, kpsingh@kernel.org, jmattson@google.com, mingo@redhat.com, seanjc@google.com, andrew.cooper3@citrix.com, stable@vger.kernel.org Subject: [PATCH v3 2/2] Documentation/hw-vuln: Document the interaction between IBRS and STIBP Date: Mon, 27 Feb 2023 07:05:41 +0100 Message-Id: <20230227060541.1939092-2-kpsingh@kernel.org> X-Mailer: git-send-email 2.39.2.637.g21b0678d19-goog In-Reply-To: <20230227060541.1939092-1-kpsingh@kernel.org> References: <20230227060541.1939092-1-kpsingh@kernel.org> MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1758964282111023741?= X-GMAIL-MSGID: =?utf-8?q?1758964282111023741?= Explain why STIBP is needed with legacy IBRS as currently implemented (KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled. Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") Cc: stable@vger.kernel.org Signed-off-by: KP Singh --- Documentation/admin-guide/hw-vuln/spectre.rst | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst index 3fe6511c5405..4d186f599d90 100644 --- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -479,8 +479,16 @@ Spectre variant 2 On Intel Skylake-era systems the mitigation covers most, but not all, cases. See :ref:`[3] ` for more details. - On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced - IBRS on x86), retpoline is automatically disabled at run time. + On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS + or enhanced IBRS on x86), retpoline is automatically disabled at run time. + + Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at + boot, by setting the IBRS bit, and they're automatically protected against + Spectre v2 variant attacks, including cross-thread branch target injections + on SMT systems (STIBP). In other words, eIBRS enables STIBP too. + + Legacy IBRS systems clear the IBRS bit on exit to userspace and + therefore explicitly enable STIBP for that The retpoline mitigation is turned on by default on vulnerable CPUs. It can be forced on or off by the administrator @@ -504,9 +512,12 @@ Spectre variant 2 For Spectre variant 2 mitigation, individual user programs can be compiled with return trampolines for indirect branches. This protects them from consuming poisoned entries in the branch - target buffer left by malicious software. Alternatively, the - programs can disable their indirect branch speculation via prctl() - (See :ref:`Documentation/userspace-api/spec_ctrl.rst `). + target buffer left by malicious software. + + On legacy IBRS systems, at return to userspace, implicit STIBP is disabled + because the kernel clears the IBRS bit. In this case, the userspace programs + can disable indirect branch speculation via prctl() (See + :ref:`Documentation/userspace-api/spec_ctrl.rst `). On x86, this will turn on STIBP to guard against attacks from the sibling thread when the user program is running, and use IBPB to flush the branch target buffer when switching to/from the program.